BNPL comes of age

For years, Buy Now Pay Later (BNPL), or Deferred Payment Credit (DPC), has operated outside the FCA’s perimeter. However, that era is ending. The FCA confirms that DPC/BNPL will be regulated from 15 July 2026 (“Regulation Day”), with the current consultation closing on 26 September 2025, and a policy statement with final rules expected in early 2026.

This is a watershed moment: firms offering BNPL or DPC now need to use the lead-in period to reassess permissions, governance and journeys in line with the FCA’s staged timetable.

 

What is changing and why it matters

From Regulation Day, BNPL will no longer be an unregulated product. It will be treated as a regulated consumer credit agreement when provided by third-party lenders. This means firms will need to be authorised by the FCA to continue offering BNPL.

Authorisation, in this case, means demonstrating to the FCA that your firm can:

  • lend responsibly and affordably;
  • provide clear pre- and post-contract information;
  • support customers who fall into financial difficulty; and
  • submit product sales data to the regulator.

If you are not authorised (or in the Temporary Permissions Regime), you must stop offering BNPL from 15 July 2026. This aligns BNPL with the wider credit market, reducing consumer harm while still allowing room for innovation.

 

Scope: who and what is in (and out)

Regulated from Regulation Day: DPC agreements provided by third-party lenders (where the merchant and lender are different, and there’s an arrangement under which the lender becomes the legal supplier) will be regulated credit agreements.

Excluded:

  • DPC used to finance insurance premiums, employee borrowing, or provided by registered social landlords (including certain Scottish shared-ownership cases) will not be regulated.
  • Agreements entered into before Regulation Day remain exempt.
  • Broking of DPC agreements is exempt from regulation.

 

Temporary Permissions Regime (TPR): how to keep operating

From Regulation Day, any DPC lender entering into DPC agreements must be authorised for the relevant consumer credit activities or have a temporary permission under the DPC TPR.

The TPR is not full authorisation – it is a temporary measure that allows firms already active in BNPL to keep operating legally while they apply for and obtain full FCA authorisation. Entering the TPR buys time, but it does not remove the requirement to go through the authorisation process.

 

To enter the TPR, firms must:

  • Have been carrying on a DPC activity on 15 July 2025 (the initial commencement date of the government’s legislation).
  • Notify the FCA before Regulation Day and pay the TPR registration fee (the fee level will be consulted on separately).
  • Provide evidence of DPC lending on 15 July 2025 and firm details (registered office, trading names, controllers, and senior managers).

Timing: The FCA will open TPR notifications two months before Regulation Day and close them two weeks before Regulation Day. The exact dates will be published in due course.

If you choose not to enter the TPR and are not already authorised, you must stop any DPC activities subject to regulation by Regulation Day. Firms without permission / TPR may continue servicing pre-regulation day DPC agreements (those remain exempt).

In practice, the TPR keeps you in the market temporarily, but you will still need to prepare and submit a full authorisation application.

 

A broader consumer credit makeover

BNPL reform sits within the FCA’s aim to set high standards, reduce harm, and supervise effectively – while being proportionate so the market can innovate and grow sustainably.

This is part of a wider shift to outcomes-based regulation aligned with the Consumer Duty – from prescriptive boxes to demonstrable good outcomes.

 

What compliance leaders should do now

The FCA has set out clearly what will be required. For firms, the question is no longer if BNPL will be regulated, but how to prepare. Entering the TPR will only keep you operating temporarily – every firm will still need to apply for and obtain full FCA authorisation. With that in mind, the following steps should be prioritised:

  • BNPL readiness: Map whether you need authorisation or the DPC TPR. If you rely on BNPL as part of your business model, you must either be authorised by 15 July 2026 or have entered the TPR. If you enter the TPR, use the time to prepare your full authorisation application.
  • Product governance: Redesign digital journeys so they meet FCA standards – embedding “positive friction” and clear disclosures so customers can make effective, timely and informed decisions.
  • Vulnerability focus: Document and operationalise support for customers in difficulty – not just a paper policy. Ensure hardship pathways and signposting work inside BNPL journeys.
  • Data & reporting: Build your capability to capture and report product sales data for DPC lending, aligned to the FCA’s supervisory expectations.
  • Timeline discipline: Plan to hit the consultation window (until 26 September 2025), track the policy statement in early 2026, and schedule internal change to be ready for 15 July 2026.

 

Final thoughts

From 15 July 2026, BNPL becomes regulated credit when provided by third-party lenders. For compliance leaders, the immediate priority is simple: secure the right permissions, embed the FCA’s requirements into your frameworks, and be ready for Regulation Day.

The opportunity isn’t just to comply, it’s to use the regime to build trust: clear information, affordable lending, strong support for customers in difficulty, and robust reporting to evidence control.

 

At fscom, we are helping firms prepare for Regulation Day – from gap analysis and permissions mapping (including DPC TPR readiness) to Consumer Duty alignment and MI / reporting design. If you would like to test whether your BNPL framework will meet the FCA’s expectations, please get in touch.