Classify the payment platform by function
A checkout or payment platform may be a technical service provider, a payment-services firm, a credit intermediary or a creditor depending on its real activities. Operating an interface does not by itself settle the legal role. Examine who makes the credit offer, determines eligibility, concludes the agreement, sets charges and bears credit risk. Article 3 of CCD2 defines the creditor and intermediary using substantive functions. If a platform merely passes transaction messages, do not automatically impose every creditor duty on it. If it acts for remuneration in presenting or concluding agreements, the intermediary definition may be relevant. A group containing a licensed payment institution and a separate lending entity should assess the two entities individually.
Do not conflate payment authorisation and credit authorisation
A platform can execute a payment transaction while a different firm advances credit. Payment authorisation and consumer credit admission arise under different regimes and should be mapped separately. Article 37 of CCD2 concerns admission, registration and supervision of creditors and credit intermediaries, with specified treatment for certain credit institutions, payment institutions and electronic-money institutions. Its exceptions are carefully framed and should not be described as general exemptions from all credit law. Platforms that embed financing must identify applicable national authorisations, outsourcing rules and payment-services requirements rather than assuming an existing payments permission covers consumer lending. Maintain a clear legal-entity and flow-of-funds diagram for each product.
Control the user interface at each credit moment
Where a platform controls the checkout screen, it can influence what customers read before accepting credit. For in-scope agreements, Articles 10 and 12 address pre-contract information and adequate explanations. The platform should identify which screen displays prescribed content, when it is delivered on a durable medium, and how acceptance is recorded. A wallet balance, pay-later tab or saved payment method should not blur the distinction between paying with available funds and taking a new credit agreement. Article 17 requires Member States to prohibit unsolicited credit without prior request and explicit agreement. Review defaults, preselected checkboxes and one-click conversions with that prohibition in mind, subject to national implementation.
Treat finance promotions as regulated communications where applicable
A platform promoting BNPL across multiple merchants may publish cost claims, fee examples and speed-of-approval messages. Articles 7 and 8 create advertising obligations for covered credit agreements, including warning and standard-information provisions. Responsibility should be allocated in writing between the platform, merchant and creditor, but contract terms do not erase duties arising under national law. Keep offer data synchronised so a promotion does not show a lower repayment than the agreement. Test shortened mobile displays, push notifications, QR journeys and affiliate surfaces. Cross-border campaigns need local language, warning and product-scope analysis. Where the product is excluded from CCD2, other misleading-marketing and consumer laws can remain applicable.
Connect creditworthiness data with the responsible creditor
Article 18 places the creditworthiness obligation on the creditor for covered agreements and addresses the intermediary’s accurate submission of consumer information. A platform acting as intermediary should have controls for completeness, alteration logs and lawful transmission, without representing itself as the final decision maker unless that is true. A technical service provider should likewise document data roles and security under applicable privacy and outsourcing requirements. Record when an applicant has consented to a relevant step where law requires it, but do not confuse data protection consent with every other lawful basis for processing. Data minimisation, error handling and accurate attribution of decisions are particularly important when payment and lending services are combined.
Trace the complete platform complaint and dispute path
A payment platform can receive customer complaints even where the complaint concerns a lender or seller. Article 40 of CCD2 provides for access to adequate, effective out-of-court dispute-resolution procedures for covered credit disputes. Make it easy to identify the correct business, route complaints without losing records and inform consumers of relevant avenues. Claims involving returns or non-delivery may also engage linked-credit provisions in Article 27. Keep timestamps for merchant events, repayments, chargebacks, credit decisions and communications so investigations are reproducible. The national transposition and competent authority govern details. Review interfaces and contracts before 20 November 2026, when Member State CCD2 implementing measures must apply. One important platform test is a merchant switching the financing provider for only one market. The system must not continue to present the old creditor identity, APR example or complaint route to consumers in that country. Another is a delayed API response after the consumer clicks accept. Logging should distinguish a pending transaction from a credit agreement actually concluded, and the user interface should not suggest approval before a decision exists. Security and privacy reviews should address the movement of personal and payment information across entities. Data roles cannot be resolved solely by the name of an integration endpoint. The platform should retain contractually defined responsibilities, change approval records and versioned customer-interface screenshots so that each party can reconstruct what occurred during an investigation. Local supervisory expectations may require additional records.
Frequently asked questions
Is a payment platform automatically a credit intermediary?
No. The definition turns on actual activities, remuneration and whether the platform is merely introducing the consumer.
Does payment authorisation cover BNPL lending?
Not automatically. Different legal permissions and carefully framed CCD2 Article 37 exceptions must be reviewed.
Who conducts BNPL creditworthiness assessment?
For covered credit agreements, Article 18 places the obligation on the creditor, with defined intermediary information-submission responsibilities.
Primary sources
Directive (EU) 2023/2225 ↗EUR-Lex national transposition measures ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.