BNPL Creditworthiness Requirements

First establish that the BNPL agreement is in scope

CCD2 Article 18 does not turn every ordinary merchant invoice into a regulated consumer-credit application. The first task is to determine whether the arrangement is a credit agreement within the Directive and whether an Article 2 exclusion applies. Supplier-only deferred payment may qualify for Article 2(2)(h) where all conditions are met; third-party BNPL generally requires a different scope analysis. The creditworthiness requirement follows classification, not marketing terminology. Keep an approved scope determination for each credit product and market. This is important for small-ticket, interest-free instalment plans, which should not be assumed exempt merely because the consumer pays no borrowing interest. Existing national requirements may apply before CCD2 implementing measures begin operating on 20 November 2026.

Article 18 requires a thorough pre-agreement assessment

For covered consumer credit, Article 18(1) requires a thorough assessment before conclusion of the agreement, performed in the consumer’s interest to prevent irresponsible lending and over-indebtedness. It considers whether the consumer is likely to meet the obligations under the proposed agreement. Article 18(6) then requires credit to be made available only where the assessment indicates obligations are likely to be met as required. Short duration and low monetary value affect proportionality, but the Article does not provide a blanket BNPL exemption from the assessment. A firm should establish when the assessment happens in a checkout journey and ensure that a decision is reached before contractual commitment. Records should identify the product terms evaluated, the decision and the information relied upon.

Use accurate, relevant and proportionate information

Article 18(3) identifies income, expenses and other relevant financial and economic circumstances as the information basis for creditworthiness assessment. The information must be necessary and proportionate to the nature, duration, value and risks of the credit for the consumer. It may come from the consumer, appropriate internal or external sources and, where necessary, a database under Article 19. It should be appropriately verified, including by independently verifiable documents where needed. Social networks are not an external information source for this purpose, and special categories of personal data under GDPR Article 9(1) cannot be included. A BNPL provider should define evidence standards for differing risk scenarios instead of collecting every possible data field from every applicant. Proportionality is an assessment discipline, not permission to skip underwriting.

Rules apply to decision processes and intermediaries

Article 18(4) calls for established, documented and maintained creditworthiness procedures and the information used in assessment. Under Article 18(2), credit intermediaries must accurately submit necessary consumer information to the relevant creditor, consistently with the GDPR. Consequently, a platform or merchant involved in gathering application information should have clear data handoff controls where it acts as an intermediary. The creditor still needs a reliable decision process, including handling missing or inconsistent evidence. Article 18(11) permits Member States to require a database consultation, but assessment cannot be based exclusively on credit history. For a repeated BNPL customer, previous repayment performance may be relevant evidence; it does not by itself establish that a new agreement can be repaid. Procedures should address multiple concurrent obligations where relevant.

Automated BNPL decisions require specific safeguards

Fast checkout decisions may use automated processing of personal data. Article 18(8) provides a consumer right to request and obtain human intervention where creditworthiness assessment involves such processing. The rights include a comprehensible explanation of the assessment and relevant automation, an opportunity to express a point of view and a request for review of the assessment and credit-granting decision. Article 18(9) requires prompt information about a rejected application and, where applicable, notice concerning automated assessment and rights to human assessment and contestation. These protections exist alongside data-protection requirements, which must be reviewed on their own terms. A provider should design operational routes for explanations and reviews, assign trained personnel and retain records without exposing inappropriate model or customer data.

Controls for repeat use and increased credit limits

BNPL portfolios often involve multiple small purchases. Credit providers should assess the obligations of the actual proposed agreement and keep process records capable of explaining the decision. Under Article 18(10), if parties agree to change the total amount of credit after conclusion, updated creditworthiness reassessment is required before any significant increase. A new purchase or changed instalment plan should not be automatically treated as a significant increase to an existing agreement; classification depends on the contract and facts. Review the distinction between a new agreement, additional drawing and amendment before configuring decision triggers. Evidence should cover timing, data accuracy, policy version, approval outcome, human-review requests and exceptions. National implementing legislation and regulator guidance may supply further operational detail. For operational testing, select successful and rejected applications and compare the timestamp of the creditworthiness decision against the agreement-formation timestamp. Review whether income, expenditure or other financial circumstances used were sufficiently reliable for the specific risk and whether the procedure appropriately verifies them. Check whether decision logic permits an approval after missing mandatory information or a negative repayment-capacity outcome. Test the human-review route for automated assessments, including how a customer requests an explanation and how the request is routed. Where merchants collect inputs, confirm that information passed to the creditor is accurate. Repeat the checks after significant changes to credit policy, models or underwriting suppliers.

Frequently asked questions

Related research

BNPL compliance overview ↗

When Deferred Payment Is Excluded From CCD2 ↗