Regulation Day has passed, but implementation is only beginning. Since 15 July 2026, lenders offering deferred payment credit (DPC), commonly known as Buy Now Pay Later (BNPL), have been regulated by the FCA for the first time. The regime is narrower than the label suggests; it applies to lenders offering DPC through merchants, but not to merchants offering their own DPC arrangements or to the broking of DPC arrangements.
For firms that spent the past year mapping permissions, building affordability frameworks and registering for the Temporary Permissions Regime (TPR), the focus is now shifting from go-live to demonstrating that the new controls are operating effectively in practice.
Regulation Day was a starting point, not a finish line. The next milestone is already in sight. Applications for full FCA authorisation must be submitted by 15 January 2027. Until then, firms can continue offering regulated DPC agreements, but they remain subject to the FCA’s rules and ongoing supervisory oversight.
The practical question is simple: if the FCA asked for evidence of your DPC controls, could you demonstrate that they are operating effectively in practice?
What we are seeing in practice
Many firms met the July deadline by implementing the core regulatory requirements, but they are now entering a different phase. The focus is shifting from implementation to evidence. Increasingly, the challenge is not whether a policy exists, but whether firms can demonstrate that affordability assessments, Consumer Duty monitoring, complaints handling and governance operate consistently in practice.
Where do firms stand after Regulation Day?
Some firms used the period before Regulation Day to test affordability journeys, build complaints processes and train staff to identify customers in financial difficulty. Others focused primarily on securing temporary permission and are now continuing to develop the frameworks the FCA will expect to see through authorisation and supervision.
We have seen the same pattern in other newly regulated sectors, including payments and cryptoassets. Meeting the initial deadline is only one part of the process. The harder task is evidencing that controls operate consistently in day-to-day practice.
What will the FCA expect to see?
- Affordability assessments that stand up to scrutiny: the FCA requires proportionate creditworthiness assessment before each DPC agreement, including agreements below £50. The depth of the assessment will depend on the risk of the transaction, but firms must be able to evidence how that judgement was reached. A policy alone is not enough. Firms should be able to show that assessments are applied consistently, recorded properly and reviewed where appropriate.
- Consumer Duty as an ongoing obligation: DPC lenders are subject to the Consumer Duty and should monitor whether customers are receiving good outcomes over time. That includes whether customers are repaying sustainably, vulnerable customers are receiving appropriate support, and the products continue to deliver good outcomes. Management information should identify trends and prompt action where outcomes deteriorate.
- Complaints handling and Financial Ombudsman Service access: customers can refer eligible complaints about regulated DPC agreements to the Financial Ombudsman Service. DPC agreements entered into before 15 July 2026 remain outside the regime, so firms need to distinguish clearly between pre and post Regulation Day populations. Complaints data should also feed into root-cause analysis and product governance where recurring themes emerge.
- Missed payment communications and debt advice signposting: the new rules require firms to provide customers with clear, relevant information after a missed payment. In certain circumstances, including before termination or enforcement action, firms must also signpost free and impartial money guidance and debt advice. Communications should reflect the customer’s position rather than rely solely on a standard template.
- Financial promotions: DPC promotions now fall within the financial promotion regime. As much of the customer journey takes place at merchant checkout, lenders need effective oversight of the promotions communicated on their behalf and a robust approval and review process.
- Product information and reporting: firms must provide prescribed key and additional product information before entering into a regulated DPC agreement, with copies provided in a durable medium afterwards. Regulatory reporting requirements also apply, subject to the relevant transitional arrangements for firms in the TPR. Both areas need clear ownership after go-live.
FCA readiness check
Regulation Day may have passed, but many firms are now entering the phase where implementation gives way to supervision. If the FCA requested evidence of your DPC framework today, could you demonstrate that your controls are operating effectively in practice?
Consider the following questions:
- Can you evidence how affordability assessments are applied consistently across customer journeys?
- Is Consumer Duty management information being used to monitor customer outcomes and identify emerging risks?
- Are complaints analysed for root causes and fed back into product governance and control improvements?
- Do your missed payment communications and customer support processes reflect the new regulatory requirements?
- Are financial promotions, including those delivered through merchants, subject to appropriate oversight and approval?
- Is there clear ownership of regulatory reporting, governance and the FCA authorisation application?
If the answer to any of these questions is “no” or “not yet”, now is the time to address those gaps before the FCA’s supervisory focus intensifies.
What compliance leaders should do over the next six months
- Treat the TPR as time-limited: firms operating under temporary permission need to submit their application before the six-month window closes on 15 January 2027. Use the time to prepare the application and continue embedding the new controls.
- Test controls against real customer files: sample-test affordability decisions and Consumer Duty outcomes against actual lending data, rather than relying on policy design alone.
- Build outcomes-focused management information: move beyond point-in-time compliance checks towards MI that tracks customer outcomes and control performance over time.
- Review complaints for root cause: identify recurring themes and feed findings back into product design, customer journeys and control improvements.
- Be ready for FCA engagement: governance, senior manager accountability and reporting should already be clear and implemented, not built once a request lands.
The bottom line
Regulation day was the milestone everyone was watching, but the next major milestone is the authorisation application. The FCA has said it will engage closely with the firms in the TPR as part of the authorisation and supervisory process, including monitoring conduct and compliance with the new rules. The firm is best placed for that engagement will be those that can evidence how their controls work in practice.
Whether you are preparing your full authorisation application or assessing whether your DPC framework would withstand FCA scrutiny, fscom can help. We support firms with authorisation, Consumer Duty implementation, governance reviews and compliance assurance.
This article reflects our understanding of the regulatory position as at 13 August 2026. It is provided for general information and does not constitute regulatory advice specific to any firm’s circumstances.
This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.
