The UK has brought third-party buy now, pay later lending under Financial Conduct Authority regulation, closing a longstanding gap between checkout credit and other consumer-credit products.
From 15 July 2026, a lender entering into a new deferred payment credit agreement must hold the relevant FCA authorisation or a temporary permission and comply with the regulator’s rules. A firm without either can continue servicing agreements made before regulation day, but cannot enter into new regulated agreements.
The change makes accountability at checkout more explicit. BNPL lenders must provide clear information, conduct proportionate affordability checks and support customers in financial difficulty. Consumers can also take eligible complaints to the Financial Ombudsman Service. For merchants and payment providers, this turns lender status, product scope and customer-treatment controls into operational questions rather than optional due-diligence extras.
What the new regime covers
The FCA calls the product deferred payment credit, or DPC. Its policy statement describes DPC as interest-free credit repayable in no more than 12 instalments within 12 months. The rules generally apply where a third-party lender finances a customer’s purchase from a merchant.
That boundary matters. Merchant-own credit remains exempt, as does the broking of DPC agreements. The FCA also lists exclusions for third-party arrangements used to finance insurance premiums, certain employee borrowing and specified credit provided by registered social landlords. Agreements entered into before 15 July remain exempt.
The scope is therefore narrower than the everyday use of “BNPL” might imply. Merchants and payment platforms cannot safely classify a product from its checkout label alone. They need to identify the legal lender, the supplier relationship, when the agreement was entered into and whether a specific exclusion applies.
Lenders face an immediate permission gate
The FCA’s implementation page states that registration for the temporary permissions regime has closed. Firms already holding the required consumer-credit permissions, or registered for temporary permission, may continue entering new DPC agreements while following the applicable rules. Other firms must obtain authorisation before beginning or resuming new regulated lending.
This creates a practical control point for merchants, gateways and checkout platforms. A commercial contract saying that a provider is responsible for compliance does not by itself establish that the provider may legally originate the credit. Integrations should verify the lender’s regulatory status, preserve evidence of that check and define what happens if a permission changes or expires.
The regime also changes product and servicing controls. Lenders must give customers clear upfront details about payment amounts, due dates and the consequences of missing a payment. They must assess whether a customer can afford repayment and provide appropriate support when a borrower approaches or enters financial difficulty, including directing customers to free debt advice where appropriate.
Why merchants and payment providers are affected
The regulated lender carries the core credit obligations, but the customer encounters BNPL inside a merchant journey. Disclosures, consent records, repayment schedules, complaints routing and hardship indicators may cross several systems operated by lenders, merchants and payment technology providers.
That makes data lineage important. A lender needs evidence showing what the customer saw, which agreement applied, what affordability process ran and how missed payments or complaints were handled. Merchants need a reliable escalation route when a product is unavailable, a customer disputes a purchase or a lender’s permission status changes. Payment processors supporting collection flows should be able to distinguish ordinary payment failures from cases that require regulated customer support.
The FCA said the sector will also be subject to the Consumer Duty. For firms, that raises the importance of testing whether checkout design, disclosures and support processes produce understandable and fair outcomes, rather than treating compliance as a one-time wording exercise.
The accountability gap the rules address
HM Treasury said BNPL users previously had fewer rights than customers using a credit card or personal loan when seeking refunds for faulty goods. The government’s 15 July announcement said the new framework adds enforceable refund rights, affordability checks and support for customers in difficulty instead of moving them immediately toward debt collection.
The FCA said in February that its rules were designed for a market that grew from £0.06 billion of lending in 2017 to more than £13 billion in 2024. It cited its 2024 Financial Lives Survey as finding that 20% of UK consumers—10.9 million adults—had used BNPL in the 12 months to May 2024. Those figures are regulator estimates, but they explain why a product once treated as a checkout convenience now carries system-wide conduct implications.
Regulation does not establish that every BNPL transaction is harmful, nor does it eliminate credit risk. It establishes who is accountable for assessing affordability, explaining the agreement and supporting borrowers when repayment becomes difficult. The next test is execution: whether lenders and their merchant and technology partners can demonstrate those controls consistently across the full checkout and servicing chain.