How consumer credit scoring works in the Nordics: data sources, national registers and CCD2
Stockholm, Sweden – Consumer credit scoring in the Nordics is often described as a single regional model. It is not. Sweden, Norway, Finland and Denmark each score consumers from a different underlying data set, built by different institutions under different legal regimes, and a score that is decisive in one market can be unavailable in the one next door.
The common layer is thin: a national identity number, near-universal digital identification, and lenders that have automated the decision end to end. Beneath that, the data diverges. Sweden runs a private bureau market with unusually complete credit reporting. Norway runs statutory debt registers for unsecured credit. Finland has a state-run positive credit register. Denmark has no public register at all and relies on negative registration plus consent-based data sharing.
That divergence is about to meet a harmonised legal standard. The EU's second Consumer Credit Directive applies from 20 November 2026, and it does not simply tighten the creditworthiness assessment. It changes what a lender is allowed to base one on.
Key facts at a glance
The legal basis for the harmonised standard is Directive (EU) 2023/2225 (CCD2), which repeals Directive 2008/48/EC.
CCD2 applies from 20 November 2026. Sweden implements it through a new Consumer Credit Act, in force the same day.
Scope widens to credit from EUR 200, interest-free credit, buy-now-pay-later, short-term credit of up to three months, and overdraft facilities.
Creditworthiness assessments must be based on relevant and accurate information on income and expenses, verified where appropriate against independently verifiable documentation.
Health data and data obtained from social networks may not be used in the assessment.
Where automated processing or profiling is used, the consumer may request human intervention, an explanation of the assessment, and a review of the decision.
Credit may not be granted where the assessment indicates the consumer is unlikely to meet the obligations.
Credit scoring of natural persons is a high-risk use case under Annex III, point 5(b) of the EU AI Act. Those obligations were deferred to 2 December 2027 by Regulation (EU) 2026/1744.
What is a "credit score" in the Nordics?
In most Nordic markets the score is not a single portable number the consumer carries between lenders. It is a probability estimate produced by a licensed credit bureau, or by the lender's own model, at the moment of application. Consumers can see their own score, but lenders do not treat it as a shared currency the way a US FICO score functions.
Three inputs do most of the work everywhere: verified identity, income, and existing debt. What separates the four markets is where the debt figure comes from, and how complete it is.
That matters more than it sounds. A lender's affordability calculation is only as good as its view of what the applicant already owes. Every Nordic reform of the last decade has targeted that single gap.
How does credit scoring work in Sweden?
Sweden has a private bureau market governed by the Credit Information Act (1973:1173) and supervised by the Swedish Authority for Privacy Protection (IMY). UC is the largest bureau, alongside Creditsafe and Dun & Bradstreet.
The Swedish model is unusual in that lenders report granted credits to the bureaus, which gives the bureau file close to full coverage of outstanding consumer credit without any state register. Income is taken from tax-assessed data. Payment defaults (betalningsanmärkningar) arise from enforcement proceedings at the Swedish Enforcement Authority and remain visible for three years for private individuals and five for legal persons. Enquiries are themselves recorded and visible to other lenders for twelve months, so application frequency is a scoring signal in its own right.
The proposal for a state debt register, raised by the 2023 over-indebtedness inquiry, was not taken forward. Instead, Sweden has tightened the market from the supply side: since 1 July 2025, only banks and credit market companies may grant or broker consumer credit, with a final transition deadline of 31 July 2026 that has materially reduced the number of licensed consumer credit institutions. An interest rate cap of the reference rate plus 20 percentage points has applied since March 2025.
Mortgage lending sits under a separate regime, eased on 1 April 2026: the loan-to-value cap rose from 85% to 90%, and the stricter amortisation requirement for households borrowing above 4.5 times gross annual income was removed. Banks continue to apply internal debt-to-income limits, and the KALP affordability calculation, regardless.
How does credit scoring work in Norway?
Norway added a statutory layer the others lack. Under the Debt Information Act, three licensed debt information undertakings, Gjeldsregisteret AS, Norsk Gjeldsinformasjon AS and Experian Gjeldsregister AS have operated since 1 July 2019. Financial undertakings must report unsecured debt, and reporting is close to real time.
The registers cover consumer loans, credit cards, revolving facilities and charge accounts, with balance and credit limit for each. Notably, the full limit is visible, not only the drawn amount, so an unused card line reduces borrowing capacity. Mortgages, secured car loans and student loans are not included, and payment defaults (betalingsanmerkninger) sit with the credit bureaus rather than in the debt registers.
Above that data layer sits the Lending Regulation. Total debt may not exceed five times gross annual income, the borrower must withstand an interest rate three percentage points above the contract rate, and residential mortgages are capped at 90% of a prudent valuation. Banks hold a quarterly flexibility quota for loans that breach one or more requirements.
Norway is an EEA state, so CCD2 does not apply automatically or on the same date. Norwegian lending practice already meets several of its requirements, but the timing of EEA adoption is a separate question from 20 November 2026.
How does credit scoring work in Finland?
Finland went furthest toward a public solution. The positive credit register, established by Act 739/2022 and operated by the Incomes Register Unit of the Finnish Tax Administration, has been live since 1 April 2024. Lenders report the credits they grant, together with balances, terms and payment delays; income data comes from the national Incomes Register.
The obligation runs both ways. A lender must request a register extract when assessing an application for consumer credit, so the affordability picture is built on reported data rather than self-declaration.
A second phase widened it. Credits granted to natural persons for business activity were reported between 1 December 2025 and 31 March 2026, and from 1 April 2026 lenders use register data when granting credit to natural persons beyond consumers.
One distinction is easy to miss: the positive register holds credits, balances and payment delays, but not payment default entries. Those remain with the bureaus, Suomen Asiakastieto and Dun & Bradstreet, and a Finnish lender therefore queries two systems, not one.
How does credit scoring work in Denmark?
Denmark is the outlier, in that it has no statutory debt register. The reference point is RKI, the negative register operated by Experian, which records consumers and companies who have failed to pay after reminders and a creditor filing. A registration is removed when the debt is settled, and is subject to a statutory maximum retention period. Debitorlisten, operated by the collection agency Collectia, is a second negative source.
Positive credit data exists but rests on consent rather than statute. Experian's KreditStatus gives participating lenders a consolidated view of an applicant's current loans and credits, with the consumer's active consent given as part of the application, which means coverage depends on which lenders participate.
The substantive standard comes from the Credit Agreements Act and the Act on Consumer Lending Businesses, with joint guidance from the Danish FSA and the Consumer Ombudsman on what constitutes a sound credit assessment. In practice, a Danish assessment leans harder on documented income and the applicant's own disclosure of existing commitments than a Swedish or Finnish one does.
What does CCD2 change on 20 November 2026?
The directive shifts the purpose of the assessment. Under the previous framework it protected the lender's risk position; under Article 18 it is carried out in the consumer's interest, to prevent over-indebtedness. That reframing has operational consequences.
The assessment must rest on relevant and accurate information on income, expenses and existing financial commitments, proportionate to the nature, duration, value and risk of the credit, and verified where appropriate against independently verifiable documentation. Self-declared income cannot simply be treated as verified where the circumstances require independent verification. Neither does a bureau score used as the whole assessment rather than one input to it.
Two data sources are ruled out. Special categories of personal data, including health data, may not be used, and neither may information obtained from social networks.
Where the assessment involves automated processing, including profiling, the consumer has the right to obtain human intervention, a clear and comprehensible explanation of the assessment, the opportunity to state their own case, and a review of the decision. And where the assessment indicates the consumer is unlikely to meet the obligations, the credit may not be granted.
Scope widens at the same time: credit from EUR 200, interest-free credit, deferred payment and BNPL, short-term credit of up to three months, and overdrafts. Some merchants and platforms that previously sat outside the consumer credit perimeter will fall within it from November, depending on the structure of the credit or deferred-payment arrangement.
Sweden implements through a new Consumer Credit Act (prop. 2025/26:223), adopted in May 2026 and in force on 20 November 2026. It tightens the credit assessment rules, introduces a forbearance duty before collection measures, and brings more credit providers and intermediaries under supervision.
Does the EU AI Act apply to credit scoring?
Yes, and the timing changed this summer. Annex III, point 5(b) of the AI Act classifies AI systems used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, expressly excluding systems used to detect financial fraud. The consequences are data governance, technical documentation, logging, human oversight and post-market monitoring obligations.
Those obligations were due to apply from 2 August 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force from 27 July 2026, deferred standalone Annex III obligations to 2 December 2027. AI embedded in products regulated under Annex I moves to 2 August 2028.
The deferral is real but narrow. The Article 50 transparency duties were not postponed and have applied since 2 August 2026. More to the point, CCD2's explanation and human-intervention rights arrive on 20 November 2026 regardless, so a lender running an automated assessment owes the consumer an explainable decision more than a year before the AI Act's high-risk regime bites.
Where does transaction data fit?
The verification requirement is the practical pressure point. Bureau and register data tell a lender what an applicant owes; it is weaker on what the applicant earns and spends, particularly for the irregular incomes that are now common: gig work, multiple employers, variable commission, self-employment.
Account data accessed with consent under PSD2 addresses that gap directly, provided it is enriched to a standard a supervisor would accept: income identified and classified as recurring or irregular, existing credit commitments visible as outgoing payments, and the whole assessment reproducible after the fact. Raw transaction feeds do not meet that bar on their own. Categorised, versioned and auditable output does.
This is where the two regimes converge. CCD2 asks for verified income and expenses; the AI Act asks for documented data governance and explainable models. Both point at the same requirement, a decision a lender can reconstruct and defend, line by line, a year later.
Timeline: what happens next
Finland's positive credit register went live on 1 April 2024, with the business-credit phase in use from 1 April 2026. Norway's debt registers have operated since 1 July 2019. Sweden's supply-side restriction took effect on 1 July 2025, with the transition closing 31 July 2026, and Swedish mortgage rules eased on 1 April 2026.
CCD2 applies from 20 November 2026 across the EU, including Sweden, Finland and Denmark, with the transposition deadline having passed on 20 November 2025. Norway follows on an EEA timetable yet to be settled.
The AI Act's Annex III high-risk obligations apply from 2 December 2027, and Annex I from 2 August 2028.
What should Nordic lenders do now?
Four steps are concrete against the current texts.
- Separate verified data from declared data. Do this across every credit product, and identify the assessments where the decisive input is currently self-reported. These are the assessments most likely to require changes under Article 18.
- Review scope. Interest-free instalments, BNPL and low-value credit that previously carried a light assessment are inside the perimeter from November, and often sit in the fastest onboarding flows a lender operates.
- Build the explanation path before it is requested. A consumer may ask why an automated assessment reached its conclusion, and the answer has to be produced from the record, not reconstructed after the fact.
- Treat model governance as a deliverable now rather than in 2027. The sixteen-month deferral on AI Act high-risk obligations does not move the CCD2 date, and the documentation each regime requires largely overlaps.
Conclusion
The Nordic credit data infrastructures will not converge in November. Sweden will still score from bureau files, Norway from statutory debt registers, Finland from a state positive register, and Denmark from negative registration plus consent. What converges is the standard those systems are measured against: relevant and accurate information, appropriately verified, documented and explainable on request.
For lenders with mature underwriting and a weak evidence trail, the work is not building a new model. It is being able to show where each input came from.
Frequently asked questions
- Is there a single Nordic credit score? No. Each market runs its own data infrastructure, and a score is produced per lender, per application, from nationally available sources.
- Does CCD2 apply to BNPL? Yes. Deferred payment and buy-now-pay-later arrangements fall within scope from 20 November 2026, along with credit from EUR 200 and interest-free credit.
- Can lenders still use credit bureau scores? Yes, as an input. The bureau score alone does not satisfy the Article 18 requirement for relevant and accurate information on income and expenses, verified where appropriate.
- What data is prohibited in a creditworthiness assessment? Special categories of personal data, including health data, and information obtained from social networks.
- When do the AI Act rules on credit scoring apply? Annex III high-risk obligations apply from 2 December 2027, deferred from 2 August 2026 by Regulation (EU) 2026/1744. Article 50 transparency duties were not deferred.
- Does CCD2 apply in Norway? Not automatically. Norway is an EEA state and adopts EU consumer credit rules through the EEA framework, on a timetable that can differ from the EU application date.
References
Directive (EU) 2023/2225 (CCD2), on credit agreements for consumers. https://eur-lex.europa.eu/eli/dir/2023/2225/oj/eng
Regulation (EU) 2024/1689 (AI Act), Annex III, point 5(b).
Regulation (EU) 2026/1744, Digital Omnibus on AI, OJ 24 July 2026.
Prop. 2025/26:223, En ny konsumentkreditlag (Sweden). https://www.riksdagen.se/
Kreditupplysningslagen (1973:1173) (Sweden).
Lov om gjeldsinformasjon ved kredittvurdering av privatpersoner (gjeldsinformasjonsloven) and Forskrift om finansforetakenes utlånspraksis (Norway). https://lovdata.no/dokument/SF/forskrift/2020-12-09-2648
Laki positiivisesta luottotietorekisteristä (739/2022) (Finland). https://www.vero.fi/en/positivecreditregister/
Kreditaftaleloven and lov om forbrugslånsvirksomheder (Denmark).
Götgatan 22A - 559226-0128