1.   When assessing the credit risk of crowdfunding projects or project owners, crowdfunding service providers shall assess the project owner’s current and future ability to meet the financial obligations set out in the loan agreement.

2.   Crowdfunding service providers shall well document decisions on the assessment referred to in paragraph 1 and shall keep that documentation for at least 5 years after the repayment of the final instalment of the loan.

3.   For the purpose of paragraph 2, any personal data as defined in Article 4(1) of Regulation (EU) 2016/679 shall be kept for no longer than 5 years after the repayment of the final instalment of the loan.