Buy Now, Pay Later – Consumer credit obligations and regulatory considerations

Advancements in the world of fintech have fundamentally reshaped consumer behaviour through the rise of flexible payment methods, driven by surging technological developments. In turn, these shifts have necessitated substantial regulatory initiatives aimed at accommodating and governing the evolving financial ecosystem.

A prominent example is “buy now pay later” arrangements (BNPLs) which the European Banking Authority (“EBA”) has recognised as a growing trend across the EU.

As flexible payment alternatives, BNPLs are a form of short-term, unsecured consumer lending by third-party entities, where a consumer is allowed to purchase goods now and pay the merchant at a future date, either in instalments or as a lump sum payment. Generally, BNPL arrangements have three parties: (i) the customer who is acquiring the goods, (ii) the online merchant who is providing the goods, and (iii) the platform which is the entity providing the finance. The platform will pay the merchant, and in turn will then seek repayment from the customer at a later date. Typically, BNPL providers do not charge interest but often impose other fees, such as administration fees or charges for late or missed repayments.[1]

For the first time, EU legislation refers to BNPL in the preamble to Directive 2023/2225 (“CCD2”) which specifically mentions ‘buy now, pay later’ schemes “whereby the creditor grants credit to a consumer for the exclusive purpose of purchasing goods or services provided by a supplier”. The preamble describes them as “new digital financial tools that let consumers make purchases and pay them off over time, are often granted free of interest and without any other charges, and should therefore be included in the scope of this Directive.” While bringing this kind of credit within its oversight, CCD2 makes a distinction between BNPL and deferred payments, while specifying that certain deferred payments are completely excluded from the Directive’s scope. Deferred payments involve the merchant, as supplier, allowing the purchase before payment is made. In contrast, a BNPL arrangement involves a third party (not the merchant) providing credit to the consumer.[2] In the latter case, the third-party is effectively providing the consumer with funds to pay the merchant for the goods upfront whilst allowing the consumer to repay the credit provider in instalments or  at a later date.

BNPL: lending vs payment services

In terms of regulatory classification, when opining on the review of Directive 2015/2366 (“PSD2”), the EBA concluded that the core service provided in BNPL business models, is of a lending nature and should therefore be considered as granting credit. The EBA has additionally acknowledged that the provision of BNPL services often also entails a provision of a payment service within the scope of PSD2, albeit the specific payment service to be carried out depends on the particular business model at hand. In most cases, the payment services provided include the execution of payment transactions, acquiring, or money remittance. It was also of the view that the scope and requirements of PSD2 are sufficient to assess the payment services in more common BNPL business models, and do not require an additional regulatory approach.[3] Against this background, it is noted that as a matter of fact the PSD3 proposal aligns with the EBA’s position that BNPL arrangements themselves do not constitute a payment service giving their “principally lending nature” and will instead be addressed by the new CCD2.

Under Maltese law, in addition to the business of banking under the Banking Act (Chapter 371), (which by definition includes lending), one should also consider the First and Second Schedules of the Financial Institutions Act (Chapter 376) (the ‘FIA’). The FIA regulates non-bank financial institutions who carry out one of the licensable activities under the same Act, in or from Malta and on a regular and habitual basis. BNPL arrangements would be considered as a form a personal credit, therefore falling within scope of the definition of “lending” in the First Schedule of the FIA. Moreover, it is also key to mention that concurrently, PSD2 (and the Second Schedule of the FIA) allow authorised payment institutions to grant credit in relation to specific payment services, subject to a number of conditions:

1. ancillary and exclusively in connection with the execution of a payment transaction;
2. repaid within a short period not exceeding twelve (12) months;
3. not granted from the funds received for the purpose of executing a payment transaction but from the own funds of the institution.

Hence, entities that wish to provide credit under a BNPL arrangement must ensure that they have the necessary regulatory permissions under Maltese law.

The case for BNPL regulation

The EBA in the Consumer Trends Report 2024/2025 flagged over-indebtedness as the topical issue in the rising frequency of BNPL options. The EBA has reported a rise in the volume of consumer credit in general since the pandemic alongside a steady increase in small, fast, accessible, and short-term credit such as BNPL. Authorities observed inadequate creditworthiness assessments, as well as poor, and/or late provision of pre-contractual information leading to unawareness of the risks of these credit products. Information was at times found to be incomplete, not sufficiently clear, inaccurate and difficult to understand.

In its “Buy now, pay later: cross-country analysis” published in December 2023, the Bank for International Settlements commented on the risk profile of the customers in such arrangement, holding that the typical profile of a user appears high-risk – mostly because most customers are younger individuals who often do not possess credit cards or other alternative forms of consumer credit and are also typically less financially literate than older generations.

Since CCD2 expands the regulatory perimeter to capture modern fintech products that previously fell through the gaps of the 2008 framework, it  brings BNPL providers under the same rigorous supervision as traditional lenders and lending products. This ensures that short-term or fee-based rather than interest-bearing products will also be subject to consumer protection.

This shift moves the industry away from ‘one-click’ approvals. Lenders must now ensure that consumers can repay without causing undue financial hardship. A key obligation is the conduct of thorough creditworthiness assessments, taking into account relevant data such as income, expenses, and other financial details. Additionally, this type of credit would be subject to the enhanced disclosure requirements under CCDII – both before and during the contract – ensuring that the borrower has the necessary information to make an informed decision. The information must be accurate, clear, and not misleading. It is prohibited to use wording that could create false expectations about credit availability, costs, or the total amount. Additionally, customers must explicitly give consent to enter into the contract, and the business cannot assume that consent, with the use of pre-ticked boxes being prohibited. CCDII also specifically addresses the digital nature of BNPL by requiring that information is presented in a way that is adapted to the device used, ensuring that mobile users are not disadvantaged by compressed or hidden terms. By integrating these safeguards, CCD2 aims to professionalise the BNPL sector and harmonize the level of protection across the EU, regardless of whether the credit is provided by a traditional bank or a fintech institution.

In so far as banks are concerned, provisions reflecting CCDII have been transposed in the Conduct of Business Rule Book for Banks effective in November 2026. With respect to financial institutions, in its circular dated 20 November 2025, the MFSA has stated that “in view that there is no Conduct of Business Rulebook applicable to financial institutions for the time being, the CCD II requirements applicable to financial institutions are being transposed in the Financial Institutions Act (Consumer Credit) Regulations, 2025.” The provisions governing BNPL products offered by financial institutions therefore still need to be transposed within the said Regulations. The imminent entry into force of regulatory changes in Malta in the consumer credit landscape as regards the split in responsibilities between the MFSA and the Malta Competition and Consumer Affairs Authority has also signalled a more assertive or holistic approach to conduct supervision by the MFSA in the area of consumer protection generally.

Special thanks to Michael Naudi, intern within the Banking team, for his contributions.

[1] EBA CONSUMER TRENDS REPORT 2024/25 26 MARCH 2025 EBA/REP/2025/08

[2] CCDII exempts deferred payments, where a supplier of goods or a provider of services gives the consumer time to pay for a good or service free of interest and without any other charges except for limited charges for late payments in accordance with national law, provided that there is no third party, such as in ‘buy now, pay later’ schemes, offering credit for the good or service and that the payment is to be entirely executed in a limited time-frame of 50 days from the delivery of the good or provision of the service.

[3] EBA/Op/2022/06 Opinion of the European Banking Authority on its technical advice on the review of Directive (EU) 2015/2366 on payment services in the internal market (PSD2)