Executive Summary
- What is new: The FCA has published Consultation Paper 25/23 proposing new regulations for Buy Now, Pay Later (BNPL) services, now termed deferred-payment credit (DPC), with rules coming into force on 15 July 2026.
- Why it matters: The new regulations will apply to third-party lenders providing DPC through merchants, introducing requirements for creditworthiness assessments, precontract information, complaints handling and a temporary permissions regime.
- What to do next: Third-party DPC lenders should review their systems, controls and compliance frameworks, and consider whether to apply for the temporary permissions regime or prepare for full FCA authorisation under the new regime.
__________
On 14 July 2025, the UK government legislated to bring buy now, pay later (BNPL) providers into the scope of Financial Conduct Authority (FCA) regulation with the Financial Services and Markets Act 2000 (Regulated Activities etc.) (Amendment) Order 2025.
The FCA subsequently published consultation paper CP25/23: Deferred Payment Credit (Unregulated Buy Now Pay Later): Proposed Approach to Regulation on 18 July 2025 (CP25/23), outlining detailed proposals that will apply to BNPL programs, now formally referred to by the FCA as deferred-payment credit lending (DPC).
DPC refers to interest-free credit that finances the purchase of goods or services, repayable in 12 or fewer instalments within 12 months or less. FCA regulation will apply to third-party lenders providing DPC through merchants, but not to merchants that offer DPC agreements directly.
The proposals in the FCA’s consultation paper reflect the authority’s attempts to introduce a proportionate regime, relying on the outcomes-based Consumer Duty regime where possible, rather than introducing new rules.
The key proposals relate to (i) creditworthiness assessments, (ii) information requirements (covering precontract information requirements, additional product information and communications about missed repayments), (iii) rules for handling complaints and (iv) the operation of a temporary permissions regime (TPR).
The new rules will come into force on 15 July 2026 (Regulation Day). The TPR will be established to facilitate the transition, with a registration window opening two months before Regulation Day and closing two weeks before Regulation Day. Firms will then have six months to apply for full authorisation.
What Are the Key Proposals in the FCA’s Consultation Paper?
Creditworthiness Assessments
The FCA intends to apply the existing creditworthiness rules found in Section 5.2A of its Consumer Credit Sourcebook (CONC) to DPC agreements. The FCA indicated that these rules will remain unchanged and will not be customized for DPC agreements. Importantly, even DPC agreements of £50 or less will fall under these rules, as regulators will amend the definition of a “small agreement” in the Consumer Credit Act (CCA) to specifically exclude DPC agreements.
The FCA believes that the current rules under CONC 5.2A cater to a wide range of credit products and already provide sufficient flexibility, allowing firms to determine what is proportionate in assessing creditworthiness. Amid concerns about “friction” and checkout attrition, the FCA expects that DPC lenders will increasingly adopt innovative technologies, such as AI and open banking, to assess creditworthiness. However, the FCA highlights that if DPC lenders use these technologies, lenders should test and track whether their models lead to responsible and sustainable lending decisions. Importantly, automated assessment processes must not only focus on credit risk, but also sufficiently consider affordability risk.
DPC lenders are now required to incorporate all relevant information they hold about existing customers into their creditworthiness assessments. This includes any indicators of current, recent or potential financial difficulties, as well as evidence of customer vulnerability.
Despite recognising that DPC transactions can be for very small amounts and occur frequently, the FCA makes clear that a creditworthiness assessment is required for each transaction.
Although some firms may set internal credit limits and manage customer relationships in a manner similar to providing a running-account type of facility, the FCA emphasises that DPC is a fixed-sum credit. Therefore, a proportionate creditworthiness assessment must be carried out before every advance. However, the FCA recognises that successive amounts of lending may not require as detailed an assessment as the initial advance did. Nevertheless, firms must always consider whether the information they rely on remains valid, particularly where a passage of time has occurred.
Under these rules, the FCA expects DPC lenders to have adequate governance and systems and controls in place to meet the FCA’s requirements. Firms will be required to establish, implement and maintain clear and effective policies and procedures for assessing creditworthiness, including affordability. These policies should clearly outline the main factors considered during the creditworthiness assessment and must receive approval from the firm’s senior management. Firms should regularly review the effectiveness of these policies and procedures, taking action to address deficiencies. The FCA also proposes that firms keep a record of each transaction granting credit.
Precontract Information Requirements
Instead of adopting the CCA’s information requirements, the FCA proposes a new regime to allow for a proportionate and flexible regime tailored to DPC agreements.
The FCA proposes that DPC firms must proactively present certain precontractual “key product information” to customers in a prominent way, covering matters such as the interest rate, amount of credit, repayment details, cash price of the goods or services, consequences of nonpayment, and withdrawal and complaint rights. Importantly, this information must be immediately visible to customers, without requiring them to take any additional steps such as clicking a link.
The FCA also proposes that DPC firms provide or make available certain “additional product information” to customers before they enter into a DPC agreement. Unlike “key product information,” this information only needs to be easily accessible rather than immediately visible to customers. This information should include the identity of the lender (as well as the merchant or broker), details regarding early settlement options, CCA Section 75 protection, continuous payment authority mechanics and the contractual terms and conditions.
The FCA proposes a requirement for DPC firms to provide consumers with both a copy of the agreement and the key and additional product information, accessible through a “durable medium” immediately after the DPC agreement has been entered into. The FCA clarified that a “durable medium” simply means a medium that enables the recipient to store the information in an accessible way for an adequate period of time and allows unchanged reproduction of the stored information.
Information Provided During an Agreement
Given the range of DPC business models, the FCA concluded that introducing new rules requiring DPC firms to provide information throughout the life cycle of a DPC agreement would be disproportionate and unnecessary. However, the FCA proposes guidance to remind DPC firms of their obligations for consumer understanding under the Consumer Duty. The FCA notes that this guidance will encourage firms to make their own judgements, ensuring that DPC borrowers receive timely information at suitable points throughout a product’s life cycle and are equipped to make well-informed decisions. The FCA recognized that certain firms already send repayment reminders through email, SMS and push notifications, which are expected to help reduce some of these risks.
Information to DPC Borrowers Who Have Missed Repayments
The FCA proposes introducing new rules related to missed repayments:
- Firms must communicate with a customer as soon as possible after a missed repayment.
- Firms must provide customers with reasonable notice before they intend to take steps such as terminating a DPC agreement; demanding early repayment; treating customer rights as terminated, restricted or deferred; or enforcing any security.
These new rules will sit alongside the existing CONC 7 requirements that the FCA intends to apply to DPC agreements. Under CONC 7, firms must:
- Provide clear and tailored information. Firms must make available straightforward and tailored information that reflects a customer’s individual circumstances, helping customers understand their debt positions, including how information may be reported to a customer’s credit file.
- Ensure customers understand their options. Communications should enable customers to understand their options for managing their debt, including the impact of any forbearance or other support on the overall balance, and how that will be reported to their credit files.
- Use appropriate communication channels. Communication channels must be “appropriate” and should be changed depending upon the customer to ensure effective engagement.
- Signpost free and impartial debt advice. Where appropriate, firms should inform customers that free, impartial money guidance and debt advice is available, explaining its potential benefits and referring them to not-for-profit debt advice bodies.
The FCA does not specify further requirements for how, or through what medium, a firm must make these communications about missed repayments. Furthermore, the FCA generally does not prescribe the content of these communications, but does require firms to set out all of the following:
- Information enabling the customer to identify the relevant DPC agreement.
- A notification of the sums payable and still unpaid (including late fees and any other outstanding late fees under the agreement).
- An explanation of any immediate or future adverse consequences of missing the repayment, and, where relevant, steps the borrower can take to address them.
The FCA stated it wants firms to use their own judgement on what these communications should contain, in line with their Consumer Duty obligations. Under the Consumer Duty, firms must also test their communications where appropriate to ensure they are supporting good outcomes.
Rules for Handling Complaints
The FCA and the Financial Ombudsman Service (FOS) are proposing applying the requirements for handling complaints from the FCA’s “Dispute Resolution: Complaints’ Sourcebook” (DISP) to all DPC activities to ensure prompt, consistent and fair treatment of complaints.
DPC lenders subject to the TPR will need to comply with these complaints-handling rules in DISP 1. However, the FCA proposes suspending the complaints-reporting requirements for firms subject to the TPR. Upon obtaining full Part 4A permission for DPC activities, a firm must then comply with the complaints-reporting requirements and include any previously unreported DPC complaints in its first complaints report.
The FOS will only consider complaints about regulated agreements entered into on or after Regulation Day. This also covers firms operating under the TPR, even if they later exit the regime or do not become FCA-authorised, provided the agreement was entered into on or after Regulation Day.
Temporary Permissions Regime
The TPR will permit firms that do not hold the necessary permissions to continue operating while their applications for full authorisation are under review.
These firms will need to notify the FCA before Regulation Day. (As mentioned above, the notification for registration for the TPR will open two months before Regulation Day and close two weeks before Regulation Day.)
Firms are only eligible to enter the TPR if they meet all of the following criteria:
- They were carrying on a DPC activity (which will become a regulated activity on Regulation Day) as of 15 July 2025.
- They have notified the FCA accordingly.
- They have paid the relevant registration fee (to be consulted on further by the FCA).
Eligible firms will be required to provide:
- Proof that they were conducting DPC lending as of 15 July 2025.
- Firm details, including their registered office, principal place of business and any trading names.
- Information about the firm’s controllers and senior managers.
The TPR will commence on Regulation Day, and firms under the TPR will be able to apply for full authorisation within a six-month window following Regulation Day.
Firms not registered for the TPR and without the relevant permissions will not be able to undertake new DPC lending from Regulation Day onwards. However, they may continue servicing agreements entered into before Regulation Day, as these remain unregulated.
Next Steps
The FCA welcomes feedback on CP25/23 by 26 September 2025. The authority plans to issue a policy statement with final rules in early 2026, with the regulations taking effect on Regulation Day (15 July 2026).
Third-party DPC lenders should consider whether they want to become authorised under the new regime.
- If so, they should begin reviewing their systems, controls and compliance frameworks and assessing the potential expenses of compliance with the FCA’s authorisation standards.
- Alternatively, lenders should consider whether applying for the TPR would be useful to provide additional time to align their operations with the FCA’s standards for full authorisation.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.