The Consumer Credit Law Amendment Act 2026

What lenders and consumers are facing now; Author: Birgit Meisinger

Background and purpose of the reform

The previous EU Consumer Credit Directive from 2008 (Directive 2008/48/EC) had, since its introduction, led to a fragmented legal framework in many member states and was no longer compatible with developments in the digital financial market – especially new financing models such as “Buy Now Pay Later.” The new EU Consumer Credit Directive 2023/2225 (so-called “CCD II”) now brings about far-reaching changes. It entered into force on October 30th, 2023, and requires member states to transpose it by November 20th, 2025.

Austria – like many other member states – was unable to meet this deadline. With the ministerial draft published on February 11th, 2026 (79/ME XXVIII. GP), the Federal Ministry of Justice has submitted the Consumer Credit Law Amendment Act 2026 (VerKRÄG 2026) for consultation. The draft provides, among other things, for the complete repeal of the current Consumer Credit Act (VKrG, Federal Law Gazette I No. 28/2010, last amended by Federal Law Gazette I No. 6/2025) and the enactment of a new Consumer Credit Act 2026 (VKrG 2026).

The previous Consumer Credit Act (VKrG) is set to expire at the end of November 19th, 2026, but will remain applicable to all contracts concluded before November 20th, 2026. However, certain provisions of the VKrG 2026 will also apply to some “old contracts” that are still in effect. A closer look at the transitional provisions is therefore worthwhile.

Key substantive changes

Significant expansion of the scope of application

With the Consumer Credit Act 2026 (VKrG 2026), Austrian consumer credit law is undergoing a substantial expansion of its scope of application. In the future, it will no longer only cover traditional interest-bearing consumer loans, but essentially any form of deferred payment or financing assistance – even if granted on a short-term basis or free of charge. The background is the business model “Buy Now Pay Later” (“BNPL”), which from the perspective of EU legislators required regulation and had largely operated in a legal gray area in online commerce. The previous de minimis threshold of EUR 200 and the exemption for interest-free and fee-free (i.e., gratuitous) contracts are to be eliminated. As a result, “zero-percent financing” will also fall under the VKrG 2026.

However, to avoid unnecessarily burdening economically sensible payment practices, important exceptions have been introduced: Typical payment deferrals by goods suppliers and service providers will remain excluded under certain conditions, depending on the size of the company and the duration of the payment deferral (section 39(2)(3) VKrG 2026). Common credit card payments with delayed processing (“debit cards with deferred payment“) have also been excluded [section 39(2)(2) VKrG 2026].

In a nutshell: Companies that offer payment deferrals, zero-percent financing, or operate buy-now-pay-later (BNPL) models will in the future be subject to the full scope of obligations under consumer credit law – including all information, verification, and documentation requirements.

Stricter creditworthiness assessment

The VKrG 2026 fundamentally tightens the requirements for creditworthiness assessments (section 17 VKrG 2026). In the future, granting a loan will only be permitted following a positive creditworthiness assessment – that is, if the assessment concludes that the consumer is “likely” to be able to fulfill their obligations under the credit agreement in accordance with the terms of the contract. The assessment must be based on meaningful information, particularly regarding income, expenses, assets, and liabilities, drawing on both internal and external sources (including databases). Data from social networks as well as particularly sensitive data (e.g., health data) are expressly prohibited for creditworthiness assessments.

Additionally, new specific regulations have been introduced regarding automated creditworthiness assessments conducted by AI systems: Consumers are granted the right to an explanation and to human intervention or review of credit decisions made automatically.

If a loan application is rejected, the consumer must be informed of this and – if the rejection is based on automated data processing – must also be notified of this fact, as well as of the consumer’s right to have the decision reviewed by a person and of the procedure for challenging the decision.

New and expanded information requirements

The VKrG 2026 introduces new and expanded information duties for businesses: Pre-contractual information (sections 10 et seq. VKrG 2026) must be provided earlier, more clearly, and in a consumer-friendly format. Another new requirement is the obligation to actively remind consumers of their right of withdrawal if the pre-contractual information was delivered less than one day before the contract was concluded.

Furthermore, there is also an obligation to provide general information (section 9 VKrG 2026).

New prohibitions and protective measures

For the first time, a prohibition of discrimination (section 5 VKrG 2026) and a ban on granting unsolicited loans (section 7 VKrG 2026) are codified into law. The latter is of considerable practical importance in light of aggressive marketing practices in the digital credit market. A new obligation is to take lenient measures in cases of payment arrears.

Regarding the right of withdrawal, an absolute withdrawal period of twelve months and 14 days [section 25(4) VKrG 2026] is also to be introduced in order to eliminate the “perpetual” right of withdrawal in cases of erroneous instruction. In addition, prohibitions and restrictions on tying and bundling practices have been implemented, modeled after the Mortgage Credit Directive 2014/17/EU and the Austrian Mortgage and Real Estate Credit Act (HIKrG). Thus, under the new section 14 VKrG 2026, tying practices are generally prohibited unless a statutory exemption applies. However, the opening or maintenance of a checking or savings account may be required as a condition for granting credit. The tying of credit agreements to the conclusion of insurance contracts is also to be permitted, provided that insurance policies from other providers are accepted.

Due to specific deviations and rewordings in the provisions derived from the Mortgage Credit Directive, literature and case law on the HIKrG cannot be applied without reservation.

Adjustments to digitalization

The definitions have been expanded to include the term “profiling” and refer in this regard to Article 4(4) of the GDPR. Profiling refers to any form of automated processing of personal data intended to evaluate personal aspects (behavior, financial situation, interests) in order to produce analyses or predictions. When an offer is transmitted based on profiling, a pre-contractual duty to provide information now also applies.

It will also be explicitly stipulated in the future that, in the case of preselected options – such as pre-checked boxes – the consumer’s consent to enter into a credit agreement is not considered given. Creditors must therefore ensure that, in the design of their processes, the consumer’s consent to enter into the credit agreement or to acquire ancillary services is given through an unambiguous and clear affirmative action, by which the consumer voluntarily, in an informed manner, and unmistakably expresses their agreement with the content and substance of the offer conveyed by the checkbox. Comparable to section 6c of the Austrian Consumer Protection Act (KSchG), it is, however, possible to remedy the invalidity of the agreement through subsequent consent by the consumer.

Additionally, requirements for the presentation of information on mobile devices are defined.

Stricter sanctions regime and competence of the Financial Market Authority (FMA)

The new law introduces, for the first time, fines for all violations of the VKrG 2026, thereby establishing a comprehensive administrative sanctions system. The district administrative authority (which remains competent) that issued the final penalty notice must in the future forward it to the FMA or the competent trade authority. These authorities, in turn, may publish the legally binding fine on their website as part of their supervisory activities.

At this point, reference should also be made to the ministerial draft 77/ME XXVIII. GP of the Federal Ministry of Finance amending the Banking Act (BWG), which serves to implement the CCD II in the supervisory context for credit institutions. The most significant innovation therein is the separation between individual and collective consumer protection. For the first time, the FMA is granted explicit authority over collective consumer protection under consumer credit law: Credit institutions must, among other things, take appropriate measures to prevent significant, persistent, or repeated (i.e., systematic) violations of the VKrG 2026. Individual consumer protection, however, remains subject to enforcement under civil law.

The centerpiece of the planned BWG amendment is the new section 33a BWG, which obliges credit institutions to implement a series of measures and compliance precautions. Violations of the obligations to maintain appropriate and effective precautions under section 33a(1) BWG may be sanctioned with a fine of up to EUR 150,000.

Current status of the legislative process

The ministerial draft (79/ME XXVIII. GP) was submitted for public consultation by the Federal Ministry of Justice on February 11th, 2026. The consultation period ran until March 20th, 2026, during which numerous comments were submitted. The process is currently in the stage of evaluating the comments received and (if necessary) revising the draft. After the completion of inter-ministerial coordination, the bill is expected to be introduced as a government bill in the National Council. The law is scheduled to enter into force on November 20th, 2026, following its publication in the Federal Law Gazette.

Time pressure: Since the implementing provisions must be applied under EU law as of November 20th, 2026, and Austria has already missed the original implementation deadline (November 20th, 2025), there is considerable time pressure in the parliamentary process. Failure to implement could result in infringement proceedings by the European Commission against Austria.

Next steps and recommendations

For affected companies – particularly credit institutions, retailers with installment payment plans, BNPL providers, leasing companies, and credit intermediaries – it is advisable to begin structured preparations now. The adjustments required in light of the upcoming CCD II implementation include, in particular:

Reviewing existing product portfolios in light of the newly expanded scope of application;
Revising contract documents and standard information sheets (European Standard Information for Consumer Credit);
Establishing legally compliant creditworthiness assessment processes with complete documentation;
Adapting IT systems (standard forms, database connections, GDPR compliance);
Training staff in credit sales and compliance.

Disclaimer

This article is for general information only and does not replace legal advice. Haslinger / Nagele Rechtsanwälte GmbH assumes no liability for the content and correctness of this article.