Centrale des Crédits aux Particuliers (CCP), Belgium
Most payments firms assume the Belgian consumer credit register is a lender’s problem. It is not — one of the three things it records is an unauthorised overdraft on a payment account with no credit contract attached to it. The Centrale des Crédits aux Particuliers (CCP, or CKP in Dutch) is operated by the National Bank of Belgium. Its legal basis moved out of the Law of 10 August 2001 into Book VII of the Code de droit économique, Articles VII.148 to VII.157, with effect from 1 April 2015. The retention rules were rewritten from 1 January 2024, and Directive (EU) 2023/2225 applies from 20 November 2026.
1. What the CCP is
A single national register, held by the NBB, of consumer and mortgage credit taken on by natural persons for private purposes, together with the payment defaults arising from it. Unlike the French incident registers it is positive as well as negative: it records performing contracts, not only arrears.
Article VII.148, § 1 — in the wording in force since 1 January 2024 — charges the Bank with registering three things:
- 1° credit contracts falling within the scope of Book VII — the volet positif;
- 2° payment defaults arising from those contracts that meet the criteria fixed by royal decree — the volet négatif;
- 3° unauthorised overdrafts on a payment account to which no credit contract is linked, as referred to in Article VII.100 — also the negative section.
The carve-out in the next paragraph is narrow: the duty does not apply, for the positive section only, to the overdraft facilities repayable within one month referred to in Article VII.3, § 3, 2° where the credit amount is €1,250 or less, nor to dépassements. The exclusion releases the positive registration, not the negative one.
2. Article VII.100 and the payment account
Article VII.100, § 1 governs an overdraft on a credit opening or a payment account where the lender has explicitly prohibited any overdraft beyond the authorised credit amount. The firm suspends credit drawdowns and demands repayment of the unauthorised debit balance within a maximum of forty-five days from the day it arose.
Where it arises on a payment account to which no credit contract is linked, the amounts that may be claimed are capped by statute:
- a maximum default interest rate equal to the maximum annual percentage rate for a credit opening without a card at the date the unauthorised overdraft arose;
- agreed costs of reminder and formal-notice letters, at most one mailing per month, composed of a maximum flat amount of €7.50 plus the postage in force at the time of sending — an amount the King may index;
- a flat indemnity expressed as a percentage of the unauthorised overdraft.
Two consequences follow for an institution that never intended to grant credit in Belgium. A pricing schedule applying a general late-payment or negative-balance fee to a Belgian consumer payment account will breach the cap. And the forty-five-day clock is a hard date, not a collections preference.
3. What is recorded
Article VII.148, § 2:
- the identity of the consumer, the lender, any assignee and any person providing security;
- the contract references and the type of credit;
- the contract characteristics that allow the debit position and its evolution to be determined;
- where applicable, the reason for the default as communicated by the consumer, and any payment facilities granted;
- certain contract modifications, including the new credit expiry date and the date it was granted.
The King sets the precise content, the updating rules and the retention periods. The Bank issues the administrative and technical instructions that reporting and consulting parties must follow — the file layouts are NBB instructions rather than statute, and change without the law changing. Identification runs on the National Register number under Article VII.150: the consumer communicates it when applying, and lenders use it to identify consumers and security providers.
4. The consultation duty
Two provisions impose it, pointing at different moments.
| Provision | Duty |
|---|---|
| Art. VII.77, § 1 | Before concluding the contract, assess the consumer’s creditworthiness rigorously and verify they can meet repayment obligations; assess any personal security provider too. To that end, the lender must also consult the Centrale, except for a dépassement. |
| Art. VII.149, § 1 | Consult the Centrale before concluding a credit contract other than a dépassement, or before handing over the credit offer referred to in Articles VII.127, § 3 and VII.133. |
Article VII.77 goes further than the consultation. The King determines how the lender proves it and how long that proof is kept; access conditions to the Centrale, or to any other file used to assess solvency, must be non-discriminatory; and the lender must establish, document and retain the procedures and information underlying the assessment as a credit file for each consumer and each personal security provider. Each change in the credit amount counts as a new credit contract for these purposes.
The reporting side is Article VII.149, § 2: authorised or registered lenders, and persons designated by the King, communicate the data on each credit contract and each payment default within deadlines the King sets.
5. Who may read it, and for what
Article VII.153 closes the register. The Bank may communicate information only to the categories listed in § 1 — principally lenders and certain regulated persons — to debt-recovery undertakings but only for contracts they have actually taken over, and during testimony in criminal proceedings. Foreign credit registers may receive information only where their purposes, data and privacy protection are equivalent, and only on a reciprocal basis.
Paragraph 2 restricts use rather than access, and is the sentence most often overlooked: the information may be used only for granting or managing credit or payment services capable of burdening the private assets of a natural person. It may not be used for commercial prospecting. A credit intermediary may be told only a globalised answer — the number of contracts, the sum of the registered credit amounts, and, where credit is refused on the ground in Article VII.77, § 2, that the refusal rests on that provision.
6. Retention periods, rewritten for 2024
Articles VII.154/1 and VII.154/2, both inserted with effect from 1 January 2024, are now the operative rules.
| Positive section (VII.154/1) | Negative section (VII.154/2) | |
|---|---|---|
| Standard period | Three months and eight business days after the end of the credit contract | Twelve months from the date the contract is regularised |
| Alternative / ceiling | Where credit is repaid early, or an open credit terminated with no new drawdown possible — until repayment is communicated | Ten years maximum from the first payment default, whether or not the contract was regularised meanwhile |
| Restart | — | A new default after the ten-year ceiling starts a fresh ten-year period |
| Beyond consultation | Up to thirty years, pseudonymised, for the purposes in Article VII.153, § 4 | |
One interaction is easy to get wrong: on expiry of the positive period all data is deleted, but where a payment default exists the registration is extended for the negative periods. A contract that ended eighteen months ago is not necessarily gone.
7. What the consumer is owed
On first registration in the negative section, Article VII.151 requires the Bank to inform the consumer without delay, stating the contract reference, the purposes of the processing, the name and address of the person who supplied the data, the rights of access, rectification and erasure together with the retention periods, and the contact details of the competent supervisory administration.
Article VII.152 gives every consumer and security provider free access to the data registered in their name and the right to request rectification, also free. The mechanism matters: the Bank transmits the request to the person who supplied the data, who remains responsible for its accuracy and who must then ask the Centrale to correct it. Where a rectification is made, the Bank must communicate it to those the registered person names as having obtained information from the Centrale.
8. Three worked cases
Case A — a card settlement pushes a payment account into debit
Facts. A Belgian consumer’s account goes €180 into unauthorised debit when a delayed card settlement lands after a transfer out. There is no credit contract.
Which rule applies. Article VII.100, § 1 on charges; Article VII.148, § 1, 3° on registration.
What the practitioner does. Suspends drawdown, starts the forty-five-day clock, and checks the fee configuration against the statutory cap — reminder costs at €7.50 plus postage, once a month at most, default interest no higher than the maximum APR for a card-less credit opening. Then confirms whether the position meets the royal-decree criteria for negative registration, and whether the firm is actually connected to the Centrale to report it. A firm that discovers the reporting duty at this point has a remediation exercise, not an incident.
Case B — a one-month deferred-payment product at €900
Facts. A payments firm offers Belgian consumers a one-month overdraft facility capped at €900.
Which rule applies. Article VII.3, § 3, 2° lists the provisions that still apply to one-month overdraft facilities — among them VII.77, VII.100, VII.148 and VII.150 to VII.155. The VII.148 carve-out then releases the positive registration at or below €1,250.
What the practitioner does. Does not conclude the product sits outside the CCP. The performing contract need not be registered positively; a default on it is a different question, the Article VII.77 assessment and its documented credit file still apply, and the consultation duty is not switched off by the amount. Build the consultation and the credit file first; treat the positive-reporting exclusion as a reporting optimisation.
Case C — the consumer who says the entry is wrong
Facts. A customer refused credit elsewhere discovers a negative entry the firm reported after a disputed direct debit.
Which rule applies. Article VII.152. The request goes to the Bank, which transmits it to the reporting firm — the firm, not the Bank, is responsible for the accuracy of the content.
What the practitioner does. Treats an incoming CCP rectification request as a regulated correction workflow with an evidential standard, not as a complaint. If the entry is wrong, the firm asks the Centrale to correct it so the Bank can propagate the correction to the parties the consumer names. The failure mode is answering the consumer and never instructing the Centrale.
9. What changes on 20 November 2026
Directive (EU) 2023/2225 on credit agreements for consumers had to be transposed by 20 November 2025, and Member States apply those measures from 20 November 2026. Directive 2008/48/EC is repealed from the same date, though it continues to apply to agreements existing on 20 November 2026 until they terminate; a specified subset of the new provisions applies to all open-end agreements existing then.
The database article carries the operational changes. Member States must ensure cross-border access for creditors from other Member States on non-discriminatory conditions; access is limited to creditors under national supervision who fully comply with Regulation (EU) 2016/679; the rule covers public and private databases alike; and those databases must hold at least information on consumers’ arrears, the type of credit and the identity of the creditor. Creditors and intermediaries may not process special categories of data under Article 9(1) GDPR, nor personal data drawn from social networks.
The duty most likely to force a product change is the rejection notification: where an application is rejected on the basis of a database consultation, the creditor must inform the consumer without undue delay and free of charge of the result, the details of the database consulted and the categories of data taken into account. “Does not meet our criteria” will not satisfy that.
10. FAQ
Does a payment or e-money institution have to report to the CCP?
If it grants credit within the scope of Book VII, yes. Separately, Article VII.148, § 1, 3° extends registration to unauthorised overdrafts on a payment account to which no credit contract is linked, as referred to in Article VII.100 — which can apply to a firm that does not lend at all.
How long does a default stay registered?
Under Article VII.154/2, twelve months from regularisation, and at most ten years from the date of the first payment default whether or not the contract was regularised. A new default after that ceiling starts a fresh ten-year period.
Can CCP data be used for marketing?
No. Article VII.153, § 2 confines use to granting or managing credit or payment services capable of burdening the private assets of a natural person, and expressly prohibits use for commercial prospecting.
Can a lender in another Member State consult it?
Foreign credit registers may receive information under Article VII.153, § 1 on equivalence and reciprocity conditions. From 20 November 2026, Directive (EU) 2023/2225 additionally requires non-discriminatory access for supervised creditors from other Member States in cross-border credit.
11. What to do, today
- Check whether any Belgian payment account can go into unauthorised debit. If it can, Article VII.148, § 1, 3° is in scope whether or not you consider yourself a lender.
- Audit the Belgian fee schedule against the Article VII.100 caps, and instrument the forty-five-day repayment demand as a dated obligation in the collections flow.
- If you consult the Centrale, make the proof of consultation and the documented credit file part of the decision record — Article VII.77 requires both, and treats each change in the credit amount as a new contract.
- Build the rejection notification required from 20 November 2026 now: result of the consultation, database consulted, categories of data considered.
- Map the retention rules into your deletion schedule, remembering that a default extends a positive registration past its own expiry.
Related: The Belgian central contact point for accounts · France — FICP credit incident declarations · Ireland — the Central Credit Register · Italy — the Centrale dei Rischi · Account registers compared across the EU
