Buy Now Pay Later is a marketing description, not one legal category. The UK already regulated interest-bearing instalment credit; on 15 July 2026 the FCA also began regulating third-party Deferred Payment Credit, or DPC: interest-free credit repayable in no more than 12 instalments over no more than 12 months. A DPC lender must be authorised or hold temporary permission, make proportionate affordability checks, provide timely information, follow the Consumer Duty, support customers in difficulty and accept Financial Ombudsman complaints. Qualifying purchases can also receive Consumer Credit Act Section 75 protection. Merchant-own DPC, DPC broking and several narrow arrangements remain exempt, so the protection follows the agreement and legal entities—not the checkout button. The commercial test is equally important: merchant fees and repeat use must cover funding, fraud, operations and credit losses without turning frictionless checkout into unaffordable debt.
The decisive moment in BNPL is not the click; it is the creation of a credit obligation. A merchant sees conversion and basket size, a lender sees expected loss and funding cost, and a customer sees several smaller payments. The new UK regime joins those views by requiring the lender to test sustainability and explain the agreement before the sale becomes debt.
This guide concentrates on the UK perimeter and operating system rather than repeating Kurums’ general BNPL business-model guide. It connects the regime to open-banking data, identity and fraud controls, RegTech and the UK regulatory map. It is an institutional explanation, not a recommendation to borrow or select a provider.
What changed on 15 July 2026?
Third-party DPC moved into FCA regulation, bringing authorisation, affordability, information, Consumer Duty, arrears-support and redress requirements.
Is every pay-in-instalments offer now regulated?
No. Product terms and legal relationships matter; merchant-own DPC, pre-regulation agreements, DPC broking and specified exclusions can remain outside the new perimeter.
What determines a sustainable model?
Approval quality, repeat-use outcomes, loss and fraud rates, merchant economics, customer support and evidence of understanding must be read together.
What sits inside the UK consumer-credit system?
Consumer credit covers a wide range of obligations: credit cards, personal loans, overdrafts, motor finance, high-cost short-term credit, running-account credit and instalment products. They do not share one price, term or risk model. Some charge interest from inception; some defer interest; some earn merchant fees; and some combine credit with a retail purchase. FCA permissions and the Consumer Credit Act framework attach to the legal activity and agreement rather than the label on an app.
BNPL adds a distribution pattern: credit appears inside the purchase journey, often after a customer has selected goods but before payment. That placement can reduce the psychological prominence of borrowing. It can also be useful, allowing a predictable expense to be divided without interest. The policy challenge is to preserve that utility while preventing speed, fragmented balances and repeat use from hiding repayment pressure.
What is Deferred Payment Credit?
Deferred Payment Credit is the statutory name used for the previously exempt interest-free BNPL product brought into regulation. The FCA describes DPC as credit repayable in 12 or fewer instalments over 12 months or less. The July 2026 change applies where a third-party lender finances goods or services supplied through a merchant relationship. It does not turn every short payment plan into the same regulated product.
A familiar example is a retailer displaying a pay-in-three option provided by a separate finance company. The lender pays or settles with the merchant under their commercial arrangement and collects instalments from the customer. From 15 July 2026, entering that third-party DPC agreement requires the appropriate FCA consumer-credit permission or a valid temporary permission, and the lender must comply with the new rules.
What remains outside the new DPC perimeter?
Merchant-own credit remains the most important boundary. If the same business supplies the goods or services and provides qualifying DPC itself, the agreement can remain exempt. DPC broking is also exempt, so a merchant presenting a third-party option does not need authorisation solely for that broking activity. Existing permissions may still be needed for other credit, payment or ancillary activities.
The FCA also identifies exclusions for DPC used to finance insurance premiums, employee borrowing and specified arrangements from registered social landlords. Agreements entered before 15 July 2026 remain exempt under the earlier position. Separately, interest-bearing BNPL and other credit may already fall within established regulation. A perimeter map therefore starts with provider, supplier, date, term, instalments and price.
How does the BNPL business model earn money?
In a common model, the merchant pays the lender a fee because instalment availability may improve conversion, basket size or customer acquisition. The customer pays the purchase amount over time without contractual interest, although permitted late fees may apply. The lender funds the receivable and absorbs expected credit loss, fraud, payment processing, servicing and regulatory cost. Merchant settlement timing and customer repayment timing create a working-capital requirement.
Interest-free does not mean cost-free. The economics may be embedded in merchant margin, marketing spend or the lender’s wider relationship with the customer. A provider needs enough contribution per transaction to cover losses through a cycle, not just in a growth cohort. Late fees should not be the engine that rescues weak unit economics: dependence on customer failure conflicts with sustainable outcomes and regulatory expectations.
How does a checkout become a credit decision?
The journey normally combines identity resolution, fraud screening, eligibility, credit-risk assessment and affordability. These are related but distinct decisions. A genuine customer can still be unable to afford the loan; an affordable obligation can still be targeted by a fraudster. The lender needs to identify the applicant, test the transaction and decide whether repayment is sustainable before the agreement is formed.
Low-friction design does not eliminate the need for evidence. A lender can make a proportionate check quickly using its own repayment history, credit-reference information, declared data and—with consent—bank-account transactions. The model should escalate uncertain or higher-risk cases, set exposure limits across simultaneous plans and stop repeated applications from bypassing the intended control through multiple merchants or devices.
Affordability is not the same as credit risk
Credit risk asks whether the lender is likely to be repaid and how much it may lose. Affordability asks whether the customer can make repayments without an adverse effect on their overall financial situation. A small loan can have low expected loss because many borrowers repay, yet still be harmful to a customer whose essential expenditure leaves no buffer. Portfolio profitability is not proof of individual sustainability.
The FCA requires proportionate affordability checks before DPC is offered. Proportionality can reflect amount, duration, cumulative exposure, customer history and signs of vulnerability; it does not mean no check for a small basket. The lender should test foreseeable commitments, not merely whether a card authorisation succeeds today. Repeated use, failed payments and rapidly rising balances are signals that limits and model assumptions need review.
What role do credit files and open-banking data play?
Credit-reference data can show existing accounts, searches, arrears and repayment history, but coverage and update timing vary. Open-banking data can add a recent view of income, essential spending, other payments and cash-flow volatility when the customer consents. Internal BNPL history adds transaction-level behaviour. No single source is complete, and missing data should not be interpreted automatically as low risk.
A strong decision system records provenance, permissions, refresh times and the treatment of irregular income. It also tests whether using a proxy creates unfair outcomes. In February 2026 the FCA proposed closing gaps in credit files through designation and reciprocal data sharing; that work should be tracked as a proposal rather than treated as a completed data architecture. The same distinction applies to the wider open-finance vision.
What information must the borrower receive?
Before a regulated DPC agreement, the customer needs information that supports an informed decision. The FCA highlights the amount borrowed, repayment dates and amounts, any late fee, and the applicable rights and protections. The presentation must work on a checkout screen: critical terms should not be hidden behind several links or delivered only after the customer has become committed to the purchase.
For interest-bearing credit, APR and total-cost disclosures remain important. In April 2026 the FCA published research and opened work on whether APR communication should change; it found APR useful for comparison but total repayment information can improve understanding in some cases. That review was not itself a final replacement rule. Firms should meet current requirements while testing whether real customers understand price, term and consequences.
How does the Consumer Duty change product governance?
Regulated DPC is subject to the Consumer Duty. The lender must act to deliver good outcomes across products and services, price and value, consumer understanding and support. This turns compliance into a lifecycle question. An attractive onboarding disclosure cannot compensate for a limit strategy that encourages harmful repeat borrowing or a support channel that customers cannot reach after a missed instalment.
Product governance should identify a target market, foreseeable harm and the merchant contexts in which the product is unsuitable. Management information can compare approval, repeat use, missed payments, late fees, complaints, support outcomes and vulnerability indicators by cohort. Merchant acquisition incentives also need oversight: distribution growth should not reward categories, promotions or interface designs that undermine understanding.
What happens when a payment is missed?
A missed instalment is both a servicing event and information about the customer’s situation. The FCA expects firms to contact customers, explain the consequences and provide appropriate support. The stronger financial-difficulty framework that took effect in November 2024 across consumer credit also emphasises early, tailored engagement and, where appropriate, signposting to free debt advice.
Good forbearance may include changing payment dates, reducing or suspending payments, waiving charges or agreeing another arrangement depending on circumstances. It should not create a silent refinance that merely delays recognition of distress. Collections models need guardrails for vulnerability, clear agent discretion, monitored third parties and controls that prevent customers from taking new credit while an unresolved affordability problem persists.
How do complaints and Section 75 protection work?
Customers with a regulated DPC complaint should first ask the lender to put matters right. If the response is unsatisfactory, the customer can take an eligible complaint to the Financial Ombudsman Service. This creates an external review route that did not generally apply to the previously exempt agreement. Complaint root causes should feed back into underwriting, merchant oversight, disclosure and support—not remain a separate operations queue.
The FCA also confirms that Consumer Credit Act Section 75 can apply to regulated DPC purchases. Section 75 can make a creditor jointly liable with a supplier for qualifying misrepresentation or breach of contract, but conditions and monetary thresholds matter. It is not a blanket refund guarantee for every transaction. The agreement date, cash price, parties and debtor-creditor-supplier chain need to be checked in the specific case.
What does the merchant need to control?
DPC broking may be exempt, but merchants still shape customer outcomes. They decide placement, wording, product categories, promotions, returns and the handoff between purchase and finance. The lender should contract for compliant presentation, access to monitoring data and remediation. A merchant should understand who the lender is, whether it has permission and which entity handles refunds, complaints and cancellations.
Merchant-own DPC requires particular discipline because the regulatory exemption is not an outcomes certificate. Consumer law, data protection, advertising standards and unfair-terms rules can still apply, and poor credit design can damage customers and the brand. A business should compare the economic benefit of conversion with bad debt, operations, complaints and the possibility that future perimeter or enforcement expectations change.
How do authorisation and temporary permission work?
A firm entering new third-party DPC agreements after regulation day needs the relevant FCA consumer-credit permission or a place in the DPC Temporary Permissions Regime. Registration for that regime has closed. Temporary permission allows a listed firm to operate while moving through the full authorisation process; it is not the same as having completed authorisation, and the firm must follow applicable FCA rules from 15 July 2026.
The application case extends beyond a policy library. The FCA will expect a viable business model, suitable controllers and managers, financial resources, governance, creditworthiness and affordability systems, complaints capability, operational resilience and orderly wind-down. A lender must also map outsourced technology and merchant dependencies. Servicing legacy pre-regulation agreements does not authorise new regulated lending.
Why do product-sales data and RegTech matter?
The FCA states that fully authorised DPC firms must submit product-sales data. Granular reporting can help supervisors and firms see origination, balances, repayments and outcomes across the market. Internally, the same data should reconcile the checkout, credit ledger, payment processor, general ledger, complaints platform and regulatory return. A dashboard without consistent agreement identifiers will create confidence rather than control.
Rules engines can enforce exposure limits and disclosures; monitoring can flag multiple plans, payment failure and merchant anomalies; model governance can track drift and bias. But automation does not transfer accountability. A lender needs change approvals, versioned decision logic, explainable declines, data-quality tolerances and manual paths for vulnerable or disputed cases. The control objective is reproducible customer treatment, not maximum decision speed.
How does wider Consumer Credit Act reform fit in?
The DPC regime is live, while broader reform of the Consumer Credit Act remains a separate multi-stage programme. The government published its policy approach in May 2026, aiming to modernise the framework and place more requirements in FCA rules where appropriate. Legislative and rule changes still require their own process and timing. A 2026 policy statement should not be described as if every CCA provision has already disappeared.
Firms therefore need a regulatory change inventory with effective dates, dependencies and affected agreements. DPC implementation, credit-file proposals, APR work and CCA reform overlap in data and disclosure but are not one event. Building configurable agreement, communications and reporting systems is more durable than hard-coding today’s form. Legal review remains necessary before changing statutory notices, rights or customer remedies.
How should a UK DPC lender or programme be evaluated?
Start with perimeter evidence: legal entities, FCA status, permissions, agreement form, merchant-own or third-party relationship and treatment of legacy contracts. Then test economics through merchant yield, funding cost, fraud, first-payment default, lifetime loss, late-fee dependence, servicing cost and contribution after regulatory overhead. Growth in gross merchandise value can conceal weaker cohorts or concentration in one merchant.
Next examine outcomes. Track cumulative exposure, repeat-use frequency, affordability overrides, missed payments, time to support, forbearance success, complaints, FOS decisions, refunds and Section 75 claims. Segment by customer and merchant, not only by transaction. The strongest programme can explain why each approval was affordable, how the customer understood it and what happened when repayment did not proceed as expected.
Frequently Asked Questions
When did the FCA start regulating UK interest-free BNPL?
The FCA began regulating qualifying third-party Deferred Payment Credit agreements entered from 15 July 2026.
What counts as Deferred Payment Credit?
It is interest-free credit within the statutory conditions, described by the FCA as repayable in 12 or fewer instalments over 12 months or less.
Is merchant-own BNPL regulated under the new DPC regime?
Qualifying DPC supplied by the same business that supplies the goods or services can remain exempt, although other consumer, data and advertising obligations still apply.
Does regulated DPC receive Section 75 protection?
Section 75 can apply to qualifying regulated DPC purchases, subject to the statutory conditions, value thresholds and debtor-creditor-supplier relationship.
Does a soft credit check prove affordability?
No. Credit-file data can inform the assessment, but the lender must make a proportionate judgment about sustainable repayment using adequate evidence.
Primary Sources and Further Reading
This guide prioritises regulators, payment-system operators and company filings. Figures are the latest available at the July 2026 review date.
- FCA — Buy Now Pay Later consumer guide
- FCA — Regulating Buy Now Pay Later for firms
- FCA — PS26/1 Regulation of Deferred Payment Credit
- FCA — New protections confirmed for BNPL borrowers
- FCA — DPC borrower research and regulatory proposals
- GOV.UK — BNPL rules come into force
- FCA — PS24/2 Protections for borrowers in financial difficulty
- FCA — Reviewing whether APRs support consumer choices
- FCA — Financial Lives 2024 survey
- FCA — Proposals to close gaps in borrowers’ credit files
- GOV.UK — Consumer Credit Act 1974 reform consultation and outcome
- FCA — Consumer credit firms
- Financial Ombudsman Service — Deferred Payment Credit and BNPL complaints
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.
