Significant progress has been made in the last two months in shaping the regulatory regime for Buy Now Pay Later (BNPL). 

In May 2025 HM Treasury (HMT) announced the next phase of the regulation of BNPL by publishing a response to its consultation in October 2024. We covered the HMT’s response in our previous newsletter which you can read here. 

At that time HMT laid the draft affirmative statutory instrument (The Financial Services and Markets Act 2000 (Regulated Activities etc.) (Amendment) Order 2025) for bringing BNPL products into regulation and confirmed that the Financial Conduct Authority (FCA) will consult on its proposed rules shortly after the SI is made and will have 12 months to finalise the BNPL regime. BNPL products will then enter regulation around mid-2026. 

Both stages have now been completed with the Government legislating on 14 July to bring Deferred Payment Credit (DPC), commonly known as BNPL, under regulation starting 15 July 2026 for third-party lenders (Regulation Day) and on 18 July the FCA publishing its Consultation Paper (CP25/23) on Deferred Payment Credit (unregulated Buy Now Pay Later): proposed approach to regulation. 

CP25/23 outlines proposed rules and guidance to ensure DPC borrowers receive appropriate information, undergo creditworthiness assessments, and are protected under existing consumer credit standards. The aim is to reduce risks to consumers while supporting market innovation and sustainable growth. Key proposals include requiring proportionate affordability checks, ensuring access to independent dispute resolution, and improving data reporting to facilitate effective supervision.

The consultation closes on 26 September 2025. In the section below we draw out the key proposals from the FCA for the regulatory regime for BNPL and set out what they mean in practice for relevant firms which they may want to consider in preparation for future implementation of the rules.

Conduct standards

The FCA proposes applying tailored Consumer Credit Sourcebook (CONC) rules to DPC lenders to ensure consumer protection and responsible lending. Key measures include proportionate creditworthiness assessments, clear and timely information on repayment terms and risks, and support for customers in financial difficulty. 

Information requirements

New rules will address gaps left by the disapplication of certain Consumer Credit Act 1974 (CCA) provisions, such as requiring lenders to notify borrowers of missed payments. The FCA is not proposing to replicate these CCA provisions, instead seeking to deliver a proportionate regime that is tailored to DPC and aims to balance consumer protection with flexibility for firms. 

It is proposing the following:

• CONC 4.2 should not apply to DPC. Instead DPC lenders will need to comply with the following proposed new rules:
  • Firms must proactively (i.e., without the consumer needing to take any steps, such as clicking on a link) present key information to customers before they enter a DPC agreement. This includes information relating to- 0% interest rate, total credit amount, amount of each payment and payment schedule (number, frequency, and dates if known), consequences of missed payments and existence of key rights (withdrawal/cancellation, early repayment etc.). 
  • Firms are not required to follow specific rules on the format or content of DPC agreements. However, if they choose not to provide the full contractual terms and conditions upfront, they must clearly inform consumers that such terms exist and explain how to access them in the key product information. 
  • Other key information that are not required to be provided 'proactively', but must be made accessible to the customers before they enter a DPC agreement may include, information on the protections available under section 75 of the CCA or further detail on the potential consequences of the consumer missing payments. 
  • Firms will be required to provide product information and a copy of the agreement in a 'durable medium' immediately after a DPC agreement has been entered into. 
  • Although the FCA is not proposing new rules for providing information during a DPC agreement, it is requiring lenders to give timely information when they identify a consumer is in or approaching arrears, or is in default. The proposed new rules for DPC will sit alongside the existing CONC 7 requirements that will also apply to DPC.

Lenders should consider the following: 

• Given DPC agreements are typically entered into quickly and online, there are suggestions made in the paper for the customer journey to be simplified and engaging with use of infographics to convey information, which may help consumers to quickly understand repayment amounts and schedules. Firms could also use layering, where key information is provided upfront with cross references or links to further detail which can often increase consumers’ engagement with information. 
• Firms should bear in mind their obligations under Consumer Duty in relation to consumer support and consumer understanding. Although the FCA is not proposing new rules for providing information during a DPC agreement (other than on missed repayments or financial difficulty) as mentioned above, firms will be expected to comply with their obligations on consumer understanding under the Duty.
• Firms should note the modifications that will apply for the provision of information for DPC agreements taken out orally at a distance.
• DPC firms also providing payment services must bear in mind their disclosure obligations under the Payment Services Regulations 2017.

Creditworthiness

DPC lending will be subject to the FCA's creditworthiness rules in CONC 5.2A, without any modifications. CONC 5.2A.33R requires firms to establish, implement and maintain clear and effective policies and procedures for assessing creditworthiness, including affordability. These should set out the principal factors to be considered when assessing creditworthiness and must be approved by the firm’s senior management. This would mean relevant lenders will have to establish adequate governance and systems and controls in place to ensure that they meet the requirements under those rules and also that are suitable for DPC lending. Any use of automation or innovative technology to support lending decisions must be tested to ensure their effectiveness in producing responsible and sustainable lending decisions. Further, a creditworthiness assessment will be required for each DPC transaction, even if they are for very small amounts including DPC agreements of £50 or less. 

Authorisation

The FCA proposes a Temporary Permissions Regime (TPR) to allow firms without the necessary consumer credit permissions to continue DPC activities while their applications for authorisation are assessed. Firms must meet eligibility criteria, notify the FCA two months before Regulation Day, and pay a registration fee to enter the TPR. From Regulation Day, firms in the TPR will be supervised by the FCA, must comply with its rules, and can undertake regulated DPC activities. Firms must apply for full authorisation within six months of Regulation Day, or when their temporary permission will end.

Agreements made before Regulation Day will remain exempt. Firms in the TPR will have their activities limited to DPC unless they seek broader permissions. Firms that already have lending (Article 60B) permissions, will not need to register for the TPR or seek specific permissions to undertake DPC activities from Regulation Day. This is because their existing permissions will cover these activities. Third party lenders offering currently exempt DPC agreements, and who are not already authorised for Article 60B activities, will need to enter the TPR if they want to undertake newly regulated activity on or after Regulation Day. Merchants that split lending and retailing across 2 or more separate legal entities will need to ensure each of the relevant legal entities in their groups which are carrying on DPC lending hold the correct permissions now, register for TPR or cease their relevant operations prior to Regulation Day. 

The TPR includes a Supervised Run-Off Regime (SRO) for firms exiting without full authorisation, allowing them to service existing agreements for up to two years.

The FCA will provide guidance and publish details of TPR firms to support transparency and consumer trust. Where firms are required to include disclosures about their regulatory status in their marketing or other material, they will need to make it clear they hold a temporary permission and have not yet got full authorisation. 

Dispute resolution

The FCA proposes applying its complaints handling rules (DISP) to DPC lenders, requiring fair and prompt resolution of complaints and allowing consumers to escalate unresolved issues to the Financial Ombudsman Service (FOS). The FOS’s compulsory jurisdiction (CJ) will be extended to cover regulated DPC activities from Regulation Day, while its voluntary jurisdiction (VJ) will expand to include DPC activities carried out from EEA or Gibraltar establishments. This means that the FOS' CJ will apply to all TPR firms from Regulation Day even if a firm enters the TPR but subsequently leaves or does not become FCA authorised. However the FCA is proposing to suspend complaints reporting requirements for DPC activities for firms in the TPR until they obtain full authorisation. The suspension will also apply to authorised firms who will enter TPR to vary their permissions for DPC activities. Complaints about pre-regulation DPC agreements will not be covered. 

The FOS will handle DPC complaints based on fairness and reasonableness, with decisions binding on firms if accepted by consumers. The FCA does not propose extending Financial Services Compensation Scheme (FSCS) coverage to DPC activities, consistent with other consumer credit activities. 

Timeline and next steps

On 14 July 2025, legislation was made to bring DPC into regulation. After this consultation closes in September 2025, the FCA will consider feedback before publishing a Policy Statement with final rules in Q1 2026. 

In May-July 2026, registration will open for the TPR with registration going live on 15 July 2026. Firms must be authorised or hold temporary permission to operate. Between the 15 July 2026 and January 2027, firms with temporary permission can apply for full authorisation. From Q1 2027, the FCA will continue to determine applications for full authorisation.