New Buy Now Pay Later regulation: what do lenders need to know?

Deferred Payment Credit (“DPC”) agreements – those Buy Now Pay Later (“BNPL”) agreements not currently subject to regulation – will be brought under the umbrella of FCA regulation from 15 July 2026.
 

Firms with existing consumer credit permissions may continue to enter into new DPC agreements after that date. Firms without such permissions can only do so to the extent they register for temporary permission pending the determination of an application for authorisation. Firms without the appropriate permissions and not within the temporary permissions regime will not be able to enter into new DPC agreements unless and until they are authorised: a breach could constitute a criminal offence.

It is important to note that the new rules only apply to DPC agreements entered into on or after 15 July 2026: contracts entered into before this date are exempt and may continue to be serviced by a non-authorised entity.

What are the main changes affecting lenders?
 

Strengthened information requirements

Prior to entering into a DPC agreement, customers will need to be provided with an appropriate level of information to help them assess whether the product suits their needs. Key product information (including, for example, the amount of credit, the interest rate which applies, the number and frequency of payments required and the principal consequences of a missed payment) must be provided to the client.

In response to industry feedback, the FCA has dropped initial plans to require firms to provide details of cancellation / withdrawal rights and the right to refer a complaint to the Financial Ombudsman as part of the key product information: these will however form part of the additional product information to be provided, or at least made available, to the client prior to entering into the agreement.

During the life of the contract, further information may need to be provided – for example, to help customers understand the status of all their current DPC agreements so that they know the total amount outstanding and when repayments need to be made. This information could be proactively communicated, for example by way of SMS reminders, or simply accessible via an app. The FCA has not produced specific rules regarding these communications, considering that the range of DPC business models is such that firms should retain flexibility in this area. However, the regulator will be developing guidance in due course.

However, in respect of communications relating specifically to customers who have missed payments or are in financial difficulty, new rules will apply. Firms will be expected to notify customers as soon as they miss a payment and to give reasonable notice before they take steps to terminate an agreement or enforce certain of its terms. They will also be expected to provide, where appropriate, information which encourages effective engagement with the firm and signposts sources of free debt support.

Communications must be Consumer Duty compliant and should be monitored and tested to ensure they can be readily understood by retail customers.

Creditworthiness assessments

The FCA’s existing rules and guidance on assessing the creditworthiness of customers will be extended to DPC providers. The aim is to ensure that lenders make a reasonable assessment not just of whether the customer will repay, but also their ability to do so affordably without significantly affecting their wider financial position. While small-sum advances over short periods may pose lower risks than other credit products, the cumulative effect of repeat borrowing can be substantial. The risks are particularly acute as a higher-than-average proportion of DPC customers show characteristics of vulnerability and low financial resilience.

This means that providers will need to have adequate systems and controls to ensure compliance with these rules. They will also need to establish, implement and maintain effective policies and procedures for assessing creditworthiness, including affordability. These will need to be approved by senior management and periodically reviewed for effectiveness. Where AI and other automated tools are used to assess creditworthiness, these methods must be tested and results monitored.

Regulatory reporting requirements

Existing regulatory reporting requirements, including transaction-level data, will by and large apply to DPC providers. This will allow the FCA to track developments in the sector and to target supervisory resource as effectively as possible. However, the FCA proposes some initial tailoring of these requirements to lessen the burden on newly authorised providers.

Complaints handling

The FCA’s existing rules on the handling of customer complaints will be extended to DPC providers. Complaints must be investigated impartially and assessed fairly. A prompt written acknowledgement must be sent in response to a complaint, with a final response (or confirmation of when one will be provided) within eight weeks of receipt.

The jurisdiction of the Financial Ombudsman will be extended to cover complaints relating to DPC agreements entered into on or after 15 July 2026. During the consultation process, concerns had been raised as to the potential disproportionality of a right to refer a complaint to the Ombudsman given the typically low value on DPC loans, and the risk that meritless claims may in practice have to be settled by firms to avoid the cost and time commitment associated with a referral. There were also concerns that large volumes of referrals, perhaps encouraged by claims management companies, could imperil the overall viability of DPC products. The FCA was not however persuaded by these arguments, and the Ombudsman will have jurisdiction in respect of such complaints going forward. Firms will need to familiarise themselves with the Ombudsman process and ensure that referral rights are clearly set out in their final responses to complaints.

DPC products will not, however, be brought within the scope of the Financial Services Compensation Scheme. This is in line with most consumer credit products due to the limited risks these pose to client money.

Looking ahead
 

The FCA has confirmed that DPC providers will be subject not only to the FCA’s Consumer Credit Sourcebook but also key sections of the wider FCA Handbook including the Principles for Business, the Threshold Conditions and Senior Management Arrangements, Systems and Controls. The Senior Managers and Certification Regime, which is itself currently subject to a complete overhaul, will also apply.

The new regulatory framework is therefore comprehensive. Firms operating in this sector are likely to be the subject of significant supervisory scrutiny as it beds down.

Firms within the sector, or those proposing to enter it, should seek specialist compliance and legal advice as soon as possible in respect of applications for authorisation and, post authorisation, any concerns raised by FCA Supervision.   

About the author

Jill is a partner in Kingsley Napley’s Financial Services Group. Ranked Band 1 in Chambers, she has extensive experience in advising both firms and individuals in contentious FCA matters.