For years, buy now, pay later (BNPL) was simple to offer and simple to use. Part of the reason was regulatory. In many markets, interest-free instalment credit sat outside the consumer credit rules. That is changing fast. In 2026, two of the world’s largest markets bring BNPL inside their credit regimes, with firm dates and real obligations. Risk teams that once treated BNPL as a payments feature now have to treat it as regulated lending.

The reason regulators are acting is growth. In the UK, the market grew from about £0.06 billion in 2017 to more than £13 billion in 2024, and roughly 20% of adults used BNPL in the year to May 2024. The concern is that a smooth checkout can lead some people to borrow more than they can repay.

What also makes BNPL compliance hard in 2026 is that the three major markets are not moving in the same direction.

United States: a Federal Step Back, a State Patchwork

The US has moved away from a single federal standard. The Consumer Financial Protection Bureau (CFPB) withdrew their 2024 interpretive rule, which had treated BNPL providers like credit card issuers, on 12 May 2025. Officials with the CFPB later said they do not intend to issue a replacement.

That gap is being filled by states. New York has enacted a law that requires BNPL providers to obtain a license from its financial regulator before operating in the state. Expect more states to follow.

Some might initially assume that the lack of regulation at the federal level is a favorable situation for BNPL providers. But, the likely result is a patchwork, where the same provider faces different rules in different states, thereby making compliance much more difficult.

United Kingdom: FCA Regulation From July 2026

The UK is going the other way. From July 15, 2026, BNPL agreements offered by third-party lenders become regulated credit agreements under the Financial Conduct Authority (FCA). Lenders must be authorised, or hold a temporary permission, to keep writing new agreements.

The obligations will be familiar to other lenders. Firms must give clear, upfront information, run proportionate affordability checks before lending, support customers in financial difficulty, and meet the FCA’s Consumer Duty. Consumers also gain access to the Financial Ombudsman Service, and Section 75 protection will apply to qualifying purchases over £100. Both apply only to agreements made on or after the start date.

European Union: CCD2 From 20 November 2026

The EU’s revised Consumer Credit Directive (CCD2) applies from November 20, 2026. It brings BNPL and interest-free instalments into the consumer credit framework for the first time, including small loans below €200.

Providers must assess whether a customer can afford the credit, and they must document that decision. They must also give standardised pre-contract information, and consumers get a 14-day right of withdrawal. Because CCD2 is a directive, the detail varies by country. The Netherlands, for example, plans to ban BNPL for minors outright.

What This Means for Risk and Compliance Teams

The clear takeaway is that “BNPL compliance” is no longer one thing. A few steps will help:

• Map which products are in scope in each market. The line often depends on whether a third-party lender is involved and how long repayment takes.
• Review affordability and underwriting against the new standards, and pay close attention to documentation.
• Check that disclosures, dispute handling, and customer support meet each regime’s rules.
• Where you partner with a BNPL provider rather than lend yourself, confirm in writing who holds which obligation.

A single global process is unlikely to satisfy three different regulators. Building for divergence now is cheaper than retrofitting later.