New EU rules bring a mandatory withdrawal button to online trade

E-commerce interfaces across the EU have become more tightly regulated following the entry into force of Directive (EU) 2023/2673 on financial services contracts concluded at a distance. The directive introduces a significant new obligation for any business that operates an online interface through which consumers can conclude distance contracts: a mandatory, clearly visible withdrawal function. 

The scope of the directive is broader than its title suggests. Alongside targeted rules for financial services providers, it reshapes the consumer-facing digital experience for webshops, apps and online platforms across the EU.

Nuanced full harmonisation

Directive (EU) 2023/2673 is a full harmonisation instrument. This means that member states may not maintain or introduce diverging national provisions unless the directive expressly permits them to do so. The result is a largely uniform set of rules across all EU member states.

At the same time, the directive is designed to avoid overlap with existing sector-specific EU legislation. Where other EU legislation already govern particular financial services and contain rules on pre-contractual information, the right of withdrawal or the obligation to provide adequate explanations, then only those sector-specific provisions will apply – not the corresponding provisions of Directive 2023/2673. 

An important nuance arises where an existing EU act governing specific financial services contains rules on pre-contractual information but does not address the right of withdrawal. In that scenario, the directive's withdrawal provisions will nonetheless apply, with the sector-specific pre-contractual information rules and the directive's right-of-withdrawal provisions operating side by side.

The withdrawal button

At the heart of the directive is a straightforward idea: if a consumer has a right of withdrawal, exercising that right must be at least as easy as concluding the contract in the first place. In practice, any trader selling to consumers via an online interface must provide a simple, prominent feature allowing the consumer to exercise the withdrawal right in just a few clicks: the obligatory "withdraw from contract here" button. 

The obligation applies to all distance contracts concluded through an online interface, not only to those involving financial services. Traders operating webshops, subscription platforms, apps or any other digital sales channel will need to take stock of their current customer journeys and assess whether they meet this new standard.

The directive does not expand the substantive scope of the right of withdrawal itself. The familiar exceptions – such as personalised goods, perishable products and the like – continue to apply exactly as before. What changes is the mechanics of how withdrawal is exercised: the process must be clearer, easier to locate and genuinely user-friendly.

Financial services requirements 

For businesses offering financial services at a distance, such as insurance, brokerage, credit or investment products, Directive 2023/2673 goes further still. On top of the withdrawal function, it introduces a suite of additional obligations designed to modernise and strengthen the consumer experience in digital financial services journeys.

These include enhanced pre-contractual information duties, requiring that consumers receive richer and better-structured disclosures before committing to a contract. The directive also imposes an explicit ban on misleading interface patterns, known as "dark patterns", that nudge or manipulate consumers into decisions they would not otherwise make. Consumers are also afforded a right to human intervention in automated or digital-first customer journeys, ensuring that a human touch remains accessible even where processes are highly digitised.

These financial services-specific obligations sit alongside the general withdrawal function requirement and together form a comprehensive update to the EU's distance selling framework for financial services.

Belgian implementation

Directive (EU) 2023/2673 has only recently been transposed into Belgian law by the Act of 19 July 2026 on financial services contracts concluded at a distance, which amends the Belgian Code of Economic Law (Wetboek van Economisch Recht/Code de droit économique), specifically books VI and VII, as well as the Belgian Act of 4 April 2014 on insurances to give effect to the directive’s requirements. 

Businesses operating in Belgium should therefore treat preparation and compliance as an immediate priority, as the act is expected to enter into force in the very near future. The combination of interface redesign, documentation updates and internal process changes means that becoming compliant can involve multiple workstreams, teams and, as such, time and regulatory risk.

Osborne Clarke comment

Directive (EU) 2023/2673 is a timely reminder that EU consumer protection law continues to evolve in step with the digital economy. For most businesses selling online, the central compliance task is a focused one: review your customer journey, introduce a prominent and accessible withdrawal function, and ensure your legal documentation reflects the new reality. For financial services providers, the exercise is more substantial, requiring a thorough review of pre-contractual disclosures, interface design and the human-intervention dimension of digital onboarding flows.

Our practical recommendation is to review the related processes now, considering the following areas:

• User interface: introduce a prominent, consistently placed button or link that enables the consumer to initiate withdrawal that is easy to locate at any time. The flow should present a pre-filled but editable withdrawal form and generate a clear confirmation for the consumer.
• Legal documentation: update pre-contractual information, general terms and conditions and any relevant policies to reflect the existence and operation of the withdrawal function.
• Processes and systems: ensure that customer support and customer relationship management systems are configured to receive and process withdrawal notices automatically, and that internal workflows are in place to handle and confirm withdrawals within the applicable deadlines.
• Financial services offerings: businesses offering financial services at a distance will need to conduct a dedicated review of the additional information duties, the dark-pattern prohibitions and the human-in-the-loop requirements, and align their digital customer journeys accordingly.

Obligations are already in force. Businesses that have not yet implemented the required changes will want to treat this as a matter of urgency . Continued non-compliance carries real regulatory and reputational risk, and prompt action is the best way to limit exposure. 

We are happy to assist you in assessing the impact of these new rules on your  business and in designing a compliant, user-friendly withdrawal process.