The revised EU Consumer Credit Directive, known as CCD2, applies from 20 November 2026. It strengthens the rules around creditworthiness assessments, data use and automated decision-making.

Lenders must base their assessments on relevant, accurate and proportionate information. Special-category personal data and information obtained from social networks must not be used, and decisions cannot be based solely on a consumer’s credit history.

Where automated processing is involved, consumers must be able to obtain a clear explanation, express their point of view and request a human review of both the assessment and the credit decision.

This means lenders need to understand which data, rules and models influenced an outcome. They must also provide a genuine review process in which a person has the information and authority to reconsider the decision.

Provenir helps lenders put these requirements into practice by bringing data, decision rules, models and review workflows together within one decisioning environment. Decisions are traceable, explainable and auditable, with visibility into the data and logic behind each outcome.

Cases requiring further consideration can be referred for human review and sign-off while maintaining a clear audit trail. This helps lenders apply their policies consistently and provide evidence of how decisions were reached.

The creditor remains responsible for its lending policies, use of personal data and compliance with the national laws implementing CCD2: Provenir provides the decisioning technology and governance capabilities that support customers in meeting those responsibilities.

CCD2 sends a clear message: a credit decision should not only be fast and accurate. It must also be understandable, accountable and open to meaningful review. By combining explainable decisioning, clear audit trails and human-review workflows, Provenir helps lenders turn these regulatory expectations into practical, well-governed credit processes.

“This article is for general information and does not constitute legal or regulatory advice.”

Written By

If your institution is considering replacing its decision management platform, the RFP is where that process starts. The platform you choose will run your credit, fraud, and customer decisions for years, so the questions you ask up front matter.

Below are 10 questions we recommend every bank and financial institution include in their RFP, along with how Provenir answers each one.

Yes. Provenir supports origination, account management, collections, and fraud on one platform, with shared data integrations, models, attributes, and governance.

Institutions can implement each use case as its own service while reusing common components, which removes duplicate logic and inconsistent treatment across products and channels. Customers avoid stitching together separate engines for each stage of the lifecycle.

No. Provenir is vendor-neutral by design. The Provenir Data Marketplace provides pre-built, fully managed integrations to more than 150 global and local data providers, covering credit bureaus, fraud, identity, KYC/KYB, open banking, and alternative data.

Institutions can use their existing provider contracts and credentials. New sources are onboarded through a no-code connector framework rather than custom development, so your data strategy is never dictated by your decisioning vendor.

Yes, Business users have the full ability to manger their strategies, within a governed framework. Authorized risk and strategy teams can build, test, and deploy rules, decision trees, scorecards, and champion/challenger strategies through a low-code studio. Every change is controlled by:

The result is business agility without compromising audit or regulatory control.

Provenir’s native Simulation replays historical production decisions through proposed strategies using the original inputs and stored third-party responses. Teams can measure the impact on approval rates, risk distribution, and segment performance without re-calling data providers or incurring additional data costs.

Combined with champion/challenger testing in both real-time and batch, institutions can reduce strategy testing cycles from months to weeks.

Yes. Provenir runs real-time and batch workloads on separate, independently scaled engines, so a large overnight portfolio run never affects latency-sensitive origination traffic. In production, the platform supports more than 10,000 real-time transactions per second and more than 50 million batch records per hour.

Yes. Provenir supports bring-your-own-model deployment for Python, R, PMML, Java, and Excel-based models. Models execute natively within the decision flow and are versioned alongside the data attributes that feed them.

Built-in model monitoring, drift detection, and champion/challenger testing support model risk management. Institutions without dedicated data science teams can also build and retrain models in-platform with Provenir AI.

Every execution produces a complete decision trace capturing inputs, data sources, rules, model outputs, reason codes, and final outcomes. Provenir supports SHAP- and LIME-based local and global explainability and automated adverse action and reason code generation, mapped to the institution’s own taxonomy.

Combined with full change-management logging, this gives institutions audit-ready evidence for regulators, model validators, and fair lending reviews.

Provenir embeds AI with human-in-the-loop controls by design. The platform’s AI assistant lets users query data, interpret decision logic, and automate tasks in natural language.

Provider-agnostic LLM integration (including OpenAI, Anthropic, and privately hosted models via AWS Bedrock) lets institutions choose the right model for each workload without re-platforming. Every AI-assisted decision remains transparent, explainable, and subject to the same governance as any other strategy change.

Provenir is a cloud-native platform built on AWS, fully containerized on Kubernetes (Amazon EKS), with multi-availability-zone deployment, self-healing infrastructure, and zero-downtime upgrades. Key commitments include:

Provenir’s average implementation timeline is 6 to 12 months. For example, a top-15 U.S. credit card issuer went live on onboarding, account management, and pre-delinquency decisioning in nine months.

Migration risk is managed through parallel testing against the incumbent system, historical replay to prove decision parity, and version-controlled rollback. Institutions can then cut over with confidence rather than relying on a big-bang switch.

Replacing a decision engine is a big decision, and the right platform should hold up to detailed scrutiny. Use these questions with every vendor in your evaluation, and ask each one to show you the answers live, not just describe them. The differences become clear quickly. If your team is starting to scope a replacement, we’re happy to walk through how Provenir handles each of these in a tailored demo, or act as a sounding board on your requirements.

Written By

“Change a decisioning model without raising a ticket” reads at first as a request to bypass governance. A more productive reading treats it as a question of design: why does the ticket exist, and must the controls it represents continue to be administered through a change-management process that sits outside the decisioning environment?

In enterprise decisioning, governance serves a defined set of objectives. Changes must be attributable to an identifiable author, reviewable before they take effect, and testable against expected outcomes. Organisations must control who may make them, understand their downstream impact, and preserve a path to intervene when behaviour diverges from intent. These requirements are most acute where decisioning determines credit eligibility, pricing, fraud intervention and customer treatment, and where a poorly governed change can affect large populations before it is noticed. Traditionally, those objectives have been pursued through volume: sequential sign-offs and a uniform review applied to every change regardless of its risk. Yet rigour derives from what is actually examined, not from how many people approve it. An optimised model keeps the same requirements, namely documentation, testing, traceability and accountability, but applies them in risk-based tiers, so that the safeguards remain while the friction falls and speed ceases to be traded against safety. The ticket, on this view, is only an administrative instrument, separate from the control objectives it was introduced to satisfy.

That distinction grows more consequential as decision intelligence matures. The 2024 Gartner CDAO Agenda Survey found that a third of organisations have implemented decision intelligence, the practice of combining data, analytics and AI into decision flows that support or automate complex judgements. Gartner has since predicted that by 2027, half of business decisions will be augmented or automated by AI agents for decision intelligence. As greater intelligence enters the decision itself, the mechanisms governing changes to decisioning logic deserve comparable scrutiny.

Provenir illustrates how much of that control can reside inside the decisioning environment rather than around it. Business teams configure, test and deploy decision logic directly, while the workflow remains auditable and version-controlled. Champion/challenger capabilities allow competing strategies to be evaluated, including against live data, before broader release. Configurable rules determine when a change must halt for manual review. Each capability reconstitutes something the ticket was there to guarantee: a record of what changed, a means of comparing outcomes, and a defined point at which human judgement is required.

Framed strategically, removing the ticket is less an operational tidy-up than a shift in business model and in where competitive advantage sits. A decisioning model is rarely a durable advantage in itself, since techniques are published and comparable capabilities can be bought; what resists imitation is the organisational capacity to change decisioning logic rapidly and safely at scale, a dynamic capability through which a firm continually reconfigures its decision rules as conditions shift. Because that capacity emerges from many interacting elements, among them platform configuration, version-control discipline, champion/challenger routines and calibrated permissions, rivals cannot easily identify what produces the superior rate of safe change. That causal ambiguity is itself a barrier to imitation, and it turns a faster, safer change process from a passing operational gain into a defensible position: the decisioning function moves from issuing individual decisions to compounding many governed, evidence-tested changes into a lead that later entrants struggle to catch.

This reframes oversight itself. Interpretability and explainability have increasingly shifted governance from after-the-fact audit toward continuous, built-in accountability. Where oversight once rested on testing outcomes and trusting that a model worked, it now tends to require evidence of why it works: documented feature importance, decision logic and traceable reasoning behind each score or flag. Governance frameworks increasingly expect explainability artefacts alongside performance metrics, among them model cards, decision logs and plain-language justifications that legal, compliance and audit functions can read, not only statisticians. That widens the table, drawing risk, compliance and legal teams into model changes earlier because they can understand what is being altered, and it makes each update something the organisation can defend rather than merely deploy. The economics point the same way: McKinsey’s March 2025 State of AI survey found CEO oversight of AI governance among the factors most correlated with higher self-reported bottom-line impact from generative AI, positioning governance less as a constraint on value than as a condition of it.

For decisioning, the implication is that governance belongs in the design and operation of the platform itself, with auditability, version control, testing, permissions, monitoring and defined points of human intervention embedded within the decisioning lifecycle rather than administered beside it. Removing a ticket is legitimate only once the control it represented has demonstrably been accounted for elsewhere. Where that condition is met, the firm has not simply deleted a step; it has relocated a source of advantage into a capability that rivals find difficult to observe, and harder still to replicate.

The maturity of a decisioning capability should therefore be assessed on more than the speed and accuracy of individual decisions. An equally telling measure is whether decisioning logic can be modified efficiently while the standards that govern those modifications hold, and whether that combination is distinctive enough to constitute strategic advantage rather than mere operational convenience.

Written By

Written By