.png){kind=logo}
Vixio Intelligence
To keep up to date on Vixio webinars, events and industry and product news,
sign up today
Subscribe NowBNPL regulation is tightening in the UK, EU and US. See 5 key changes for payment companies, from FCA rules to CCD2, and how to stay compliant.
Buy Now, Pay Later (BNPL) regulation is tightening worldwide, creating new compliance considerations for payment companies offering these services.
In July 2026, the UK brought qualifying third-party deferred payment credit under FCA regulation. The EU's revised Consumer Credit Directive is due to apply from 20 November 2026, while US states are developing their own BNPL rules.
These changes don't just affect lenders. For payment companies offering BNPL at checkout, obligations depend on whether they provide the technical integration, arrange credit or handle repayments. New rules may also require changes to the customer journey, even when the lender makes the credit decision.
Requirements vary by market, too. A product may fall under consumer credit rules in one country but qualify for an exemption in another, with different implementation deadlines.
This guide explores five key BNPL regulatory developments, what they mean for payment companies and how to keep up with changing requirements.
Book a demo to see how Vixio helps payment companies monitor regulatory developments, assess their impact and manage compliance changes across markets.
BNPL regulation generally covers the credit agreement and how customers are treated throughout it. Depending on the market and the product, that can mean lender authorisation, creditworthiness checks, information shown before a customer signs up, and the way complaints or missed payments are handled.
But the label 'BNPL' doesn't tell you whether a product is regulated. A merchant allowing an invoice to be paid in 30 days may be treated differently from a pay-in-four option funded by a third-party lender.
The firm's activities matter too. Simply connecting a checkout to a lender isn't necessarily the same as introducing customers to credit or servicing their agreements.
For payment businesses, that means looking at the actual arrangement: who provides the credit, what your integration does and which responsibilities sit with each partner.
Interest-free instalments have not always been treated like traditional consumer credit. That's changing.
The important qualification is that not every deferred-payment product is caught. The UK regime covers specified forms of interest-free credit, generally repaid in 12 or fewer instalments within 12 months.
In the EU, some short-term credit provided directly by merchants can qualify for narrowly defined exclusions. The conditions matter more than the marketing name.
If you're considering a new BNPL provider, check the product structure before looking at how to integrate it. Does the lender need authorisation for that type of credit? Is your business doing anything that amounts to credit intermediation? A setup cleared for one country may need another assessment before it's used elsewhere.
Customers may see BNPL as a quick way to split a purchase, but a short repayment period doesn't necessarily remove creditworthiness requirements. Regulated UK DPC lenders must carry out appropriate assessments. CCD2 introduces creditworthiness rules for qualifying EU credit, and Australian BNPL providers carrying on regulated credit activities face responsible lending obligations.
The lender will usually make the credit decision. Yet your business may own the checkout screens or the hand-off between merchant and lender. If the lender needs more information, where does the customer provide it? If credit is declined, what happens next? These details can affect conversion and customer experience, so they need to be worked through with product teams as well as legal.
There isn't one standard assessment for every market. New Zealand, for example, applies consumer credit protections to BNPL providers while allowing conditional exemptions from certain affordability checks. Don't assume a process designed for the UK automatically works elsewhere.
BNPL obligations don't end when the customer agrees to pay in instalments. In the UK, regulated DPC lenders must meet conduct and customer-support requirements. CCD2 also strengthens borrower rights and information requirements for qualifying EU credit agreements.
A partial refund shows why this matters to payment companies. Say a customer returns one item from an order, but their instalment schedule still shows the original amount. The merchant may have issued the refund, but the lender needs the correct information to adjust the balance. If that hand-off fails, the customer is left chasing several firms.
Your agreement with a BNPL partner should be clear about who updates repayment balances, who handles a complaint and how information moves between systems. Then test that the integration actually works when a payment is disputed, a refund is partial or a customer falls behind.
A payment business may describe itself as a gateway or technology provider. Regulators will look at what it actually does. There can be a material difference between providing a technical connection and introducing borrowers, arranging agreements or collecting repayments.
That's relevant in the UK, where the scope of the DPC regime depends on how the credit is provided. CCD2 also contains conditions for excluding certain merchant-provided deferred payment. A product being branded by the merchant doesn't automatically put it outside consumer credit rules.
US states are making similar distinctions. Illinois has enacted BNPL-specific requirements, but an exemption may apply to merchants that simply offer a licensed lender's product without originating or servicing the loan. For a PSP, the sensible approach is to document each activity your business performs, then assess it under the rules of the market concerned. Don't rely solely on how responsibilities are described in the commercial contract.
One of the more demanding parts of BNPL compliance is keeping proposed rules separate from those that are already binding. Across your markets, you may be dealing with a live requirement, a future compliance date and a consultation at the same time.
Consider the dates compliance teams are working with:
These aren't interchangeable statuses. A rule that's already in force may need an immediate control review. A future deadline calls for a delivery plan, while a proposal needs monitoring until the final requirements are clear.
For payment companies active in more than one market, a useful regulatory tracker needs to show the affected product and legal entity, not just the country and publication date. Otherwise, it's difficult to tell which changes require work on your own checkout, partner contracts or operational processes.
If you're launching BNPL or reviewing an existing arrangement, start with what your business actually does. A lender's authorisation is important, but it doesn't answer every question about the PSP's own responsibilities.
These checks are particularly important when you're reusing an established BNPL integration in a new market. The technology might be identical, but the regulatory position may not be.
When rules are changing across several markets, your compliance team needs more than a stream of regulatory announcements.
You need to find out which requirements apply to your BNPL products, decide what has changed and make sure the right people act on it.
Vixio is a unified regulatory change management platform that helps bring those steps together.
Here’s how:
Vixio Horizon Scanning monitors developments from more than 1,400 regulatory authorities across 200+ jurisdictions. AI supports the discovery and filtering of updates, while regulatory analysts verify and explain what's changed.
So if you're following CCD2 implementation in the EU alongside emerging US state requirements, your team can track both without having to check every authority's website individually. Vixio Triage then helps you assess which updates are relevant to your products and markets, and which don't call for immediate action.
Say you're assessing a BNPL provider in Australia, or checking whether an EU merchant-credit arrangement falls within new rules. Vixio Country Reports give you structured research on the applicable framework, including licensing and consumer protection, across more than 200 jurisdictions.
For specific questions, VIQ, Vixio's AI regulatory assistant, draws on analyst-verified material and provides links to supporting sources. Your team can examine the underlying requirements and prepare focused questions for counsel, rather than relying on a brief summary without the regulatory text behind it.
Imagine a new BNPL disclosure rule applies to one of your markets. Compliance has identified it, but the product still needs to update the screen, legal needs to confirm the wording and someone needs to test the final journey. Vixio helps manage that follow-through.
In practical terms, you can use it to:
That gives compliance a record of the decision and the changes made, rather than leaving the work spread across emails and separate spreadsheets. It's especially useful when different deadlines apply to different BNPL products or countries
Leading businesses including SumUp, Trust Payments and Envestnet | Yodlee trust Vixio to navigate complex regulatory environments, reduce compliance research time and make more confident decisions.
As BNPL regulation evolves, Vixio brings the same trusted regulatory intelligence and expertise to teams preparing for new requirements and expanding into new markets.
See how leading financial services companies use Vixio:
BNPL regulation isn't just a question for lenders: payment companies need to understand how the rules affect their role at checkout, their partner arrangements and the customer experience after purchase, and be ready to act as requirements change.
Bringing regulatory research, monitoring and follow-up into one process makes that easier to manage across markets.
Book a demo to see how Vixio can help your team research BNPL requirements, monitor regulatory developments and manage the work needed to stay compliant.
Yes. BNPL is regulated in many markets, but the obligations depend on the credit product, provider and jurisdiction. In the UK, qualifying third-party DPC lending has been regulated by the FCA since 15 July 2026. Australia regulates covered BNPL credit activities under its National Consumer Credit Protection framework.
Possibly. A PSP extending credit to consumers may require credit authorisation. A PSP that only provides technical payment processing or an integration to an authorised lender may have a different regulatory position. Assess its actual activities—particularly arranging, servicing and collecting credit—and any local exemptions.
CCD2's new consumer credit framework is due to apply from 20 November 2026; EU member states were required to transpose the directive by 20 November 2025. The exact local requirements should be checked against each country's implementing law.
For cross-border payment businesses, the key action is to confirm the applicable rules, permissions and launch readiness in each relevant EU market.
It can. The impact depends on the provider, the credit bureau and local reporting practices. Some lenders report repayment history, while others perform checks that do not themselves affect a score. PSPs should understand their lending partners' reporting and dispute-handling processes.
Returns and disputed purchases may involve the merchant, lender and PSP. Applicable rights depend on local law and the agreement, so partners should agree who handles refunds, complaints, chargebacks and balance adjustments—and how each party is notified.
