At checkout BNPL looks like a payment method, a button beside the card, yet in law it is credit, even at zero interest. The EU's Consumer Credit Directive brings BNPL schemes into its scope because they are "often granted free of interest and without any other charges" (recital 16), and the UK regulates them as deferred payment credit from 15 July 2026 (S.I. 2025/859).
That makes a BNPL provider a fintech lender, and in the UK and the EU it carries a lender's AML duties.
What is BNPL, and why is it credit in law?
The plain meaning of BNPL is a purchase split into a few installments that the shopper repays after taking the goods. Its UK legal definition is deferred payment credit (DPC), which the FCA describes as "an interest-free credit product, repayable in 12 or fewer instalments in 12 months or less" (PS26/1).
Up to four parties take part: the shopper who borrows, the merchant who sells, the BNPL provider that lends and pays the merchant, and often a bank that funds the provider. Klarna, Afterpay and Affirm are BNPL providers (CFPB, 16 December 2021), and some merchants let their own customers pay later.
The market is large. The FCA puts the UK BNPL market at over £13 billion in 2024, up from £0.06 billion in 2017, and found that 20 percent of UK consumers, 10.9 million adults, used it in the 12 months to May 2024 (FCA, 11 February 2026).
How does BNPL work, and who benefits?
Picture a shopper (illustrative) buying a $200 jacket online and choosing pay in four. The provider checks the shopper in the seconds before the order is confirmed, pays the merchant $200 less its fee, then collects $50 at checkout and $50 every two weeks. If a payment fails, the provider carries the loss, and if the shopper's identity was stolen, the fraud loss is the provider's too.
That split is the benefit for each side. The merchant pays a fee and in return is paid up front, with no credit risk on its books. The shopper gets credit at no cost when every installment arrives on time.
Is BNPL interest free?
Often, as long as every installment is paid on time; late fees are where the cost appears, and some offers sold as BNPL are interest bearing credit agreements, already regulated, with an APR. From 15 July 2026 UK lenders must run affordability checks and answer complaints through the Financial Ombudsman, and from 20 November 2026 EU creditors must assess creditworthiness (Article 18).
What are the fraud and money laundering risks of BNPL?
Each risk lands on the lender, which has already paid the merchant:
- Synthetic identity fraud at sign up. A made up identity passes thin checks and spends once.
- Account takeover. A stolen login buys goods on the victim's credit line.
- First party fraud. A real shopper spends with no intent to repay.
- Repayments from stolen cards or money mules. The debt is cleared with someone else's money.
- Resale. Goods bought on credit are sold for cash, outside the payment trail.
- Merchants that are not what they say. A shop set up to push stolen or mule money through checkout.
The lender runs the KYC and AML checks. In the UK and the EU lending is a listed activity, so a BNPL lender is a financial institution under regulation 10 of the Money Laundering Regulations 2017 and Directive (EU) 2015/849, Article 3(2)(a). One UK carve out fits BNPL closely: a creditor whose sole listed activity is short fixed sum credit tied to services, at most 12 months under a debtor creditor supplier agreement, is outside the regulations (10(3)(b)); credit for goods gets no such exception.
The European Banking Authority treats a low value loan tied to buying a specific good as a factor that may lower risk, and unexpected repayments from third parties as one that raises it (EBA/GL/2021/02, 9.4 and 9.5).
complead, formerly Sanction Scanner, screens an individual or a business with the same API call and keeps either under monitoring after sign up, so a BNPL lender checks shoppers and merchants through one integration (AML for fintechs).
Who regulates BNPL in 2026?
Table 1. BNPL rules by jurisdiction (as of October 2026).
| Jurisdiction | Rule | In force from | What it requires | Who it covers |
|---|---|---|---|---|
| UK | S.I. 2025/859 and FCA PS26/1 | 15 July 2026 | Affordability checks, clear information, Financial Ombudsman complaints, the Consumer Duty | Third party lenders; not merchants lending directly, not brokers |
| EU | Directive (EU) 2023/2225 | 20 November 2026 | Creditworthiness assessment (Article 18) and the consumer credit rules | Creditors; not a supplier's own interest free deferral paid within 50 days with no third party credit (Article 2(2)(h)) |
| Australia | Act No. 138 of 2024 | 10 June 2025 at the latest | Consumer credit law extended to BNPL contracts, with responsible lending conduct rules | BNPL providers |
| US (federal) | CFPB interpretive rule of 31 May 2024, withdrawn | Withdrawn 12 May 2025 | Nothing since the withdrawal | None |
The same pay in four button can be regulated credit or not, depending on who lends. In the UK from 15 July 2026, the exemption for interest free deferred payment no longer covers an agreement where "the lender and the supplier are not the same person" (S.I. 2025/859, article 3), and a merchant that lets its own customers pay later stays outside, as PS26/1 says; the EU directive draws a similar line from 20 November 2026. So the KYC, affordability and AML duties follow the lender behind the checkout, and a firm onboarding a BNPL merchant asks first who funds the credit.
Which BNPL rules started in 2026?
- 11 February. The FCA published its final rules for deferred payment credit (PS26/1).
- 15 May to 1 July. UK lenders registered for temporary permissions.
- 15 July. Regulation day in the UK.
- 20 November. EU member states apply the new Consumer Credit Directive; agreements already running on that day stay outside it, apart from a few rules for open end credit (Article 2(2)(l)).
Who lends at this checkout is what a compliance team has to settle first. A provider lending to the shopper brings the credit rulebook, the affordability checks and the KYC; a merchant giving its own customers time to pay may sit outside all three.
Related terms
- Synthetic identity fraud. Fraud with an identity built from real and invented details.
- Account takeover fraud. Taking over a customer's existing account with stolen credentials.
- Money mule. Someone who lets criminals pass money through an account in their name.
- Loan fraud. Obtaining credit by deception with no intent to repay.
- Ecommerce fraud. Fraud against online shops, their payments and their customers.
- AML in lending. The anti money laundering checks a lender applies from application to last repayment.
How this entry was checked. For Table 1 Burçak Aydın (Finance Manager, complead) took every date from the rule's own commencement provision, and Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, then held each exemption against its article: S.I. 2025/859, the FCA's PS26/1 and its press release of 11 February 2026, Directive (EU) 2023/2225, Australia's Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024, and the CFPB's interpretive rule of 31 May 2024 with its withdrawal of 12 May 2025. The AML lines rest on regulation 10 of the UK Money Laundering Regulations 2017, Directive (EU) 2015/849 and the EBA ML/TF Risk Factors Guidelines, all reread on 29 October 2026; the jacket purchase is illustrative. Last reviewed: 30 October 2026.
