Cross-Border BNPL Compliance

Cross-border BNPL begins with the customer and contract, not a passport label

A BNPL provider offering instalment or deferred-payment credit to consumers in more than one country needs a market-by-market analysis. An app available in multiple languages is not proof that the same set of credit rules applies everywhere. Identify where the consumer is habitually resident, which legal entity offers credit, how the consumer is targeted, where an intermediary acts and the governing-law terms. Record who owns the receivable and whether a third party purchases it. EU harmonisation of parts of consumer credit law does not displace national implementation or all domestic consumer-protection rules. The critical compliance question is which obligations apply to this product and these parties in each targeted market.

Map consumer-credit scope before considering distribution

Directive (EU) 2023/2225 applies to credit agreements subject to its scope, while Article 2 contains important exclusions. Some supplier deferred payments may qualify for an exclusion only when the supplier grants time to pay without an offering or purchasing third party and satisfies the specified repayment and charge conditions. Particular large online suppliers face the shorter 14-day payment condition. By contrast, third-party finance should not be assumed excluded because checkout calls it pay later. For each jurisdiction, keep the contractual documents, funding flows, invoice ownership, customer journey and legal analysis together. Even where CCD2 is inapplicable, advertising, consumer contract, unfair commercial practice, payments and data-protection law may still affect the arrangement.

Determine the home and host state requirements separately

A firm should investigate whether the creditor, intermediary or another actor requires registration, permission or supervision in each market. Article 37 of CCD2 establishes an admission, registration and supervision framework with specific exclusions and options, but does not create a universal licence or passport for every BNPL business. The answer can also depend on whether an entity is already a credit institution, payment institution or electronic-money institution and the credit activity it conducts. A compliance matrix should identify the competent national authority and cite national legislation rather than extrapolating from an EU directive alone. Contractual outsourcing does not by itself transfer away responsibilities imposed on the regulated creditor. Document the precise activity rather than relying on a group-level claim to be regulated in another country. An EU consumer-credit directive is not itself a substitute for analysing the relevant authorisation rules. Store the conclusion with the date, author, regulator reference, and the business structure reviewed. A material change to the lending entity or finance flow should reopen that analysis.

Consumer location affects advertising and pre-contract journeys

A common checkout integration can conceal different disclosure and marketing obligations. Check the destination market before serving advertisements, representative examples, warning text, pre-contract forms and explanation flows. CCD2 Articles 7 and 8 deal with advertising; Articles 10 through 12 address information and explanation. The Directive is in force, but its national implementing measures apply from 20 November 2026. Until then, applicable domestic rules remain central. Relevant language, accessibility, durable-medium delivery and presentation requirements need local verification. If a product can be accessed from an unsupported country, decide whether to block the offer or build a legally reviewed journey rather than relying solely on a terms-and-conditions disclaimer.

Creditworthiness data and consumer rights do not stop at a border

For in-scope agreements, CCD2 Article 18 establishes a creditworthiness assessment, while Article 19 deals with non-discriminatory access for creditors from other Member States to relevant assessment databases in cross-border credit. Neither provision allows indiscriminate collection or exchange of personal data; the GDPR remains relevant. A provider needs governance for the source, accuracy and lawful use of credit data, alongside rules for automated assessment and available human review. Complaint routing, early repayment, arrears, forbearance and out-of-court redress also need country-specific treatment. Where merchants, platforms and financing entities work across borders, assign ownership for customer notices, escalation and evidence at every handoff. Translation quality and the timing of credit data access should also be tested before launches. In one market the consumer may rely on a national credit database; elsewhere a different source may be relevant. Record the lawful basis for processing and how inaccurate information is corrected. If a partner cannot meet a required local standard, that gap needs an accountable resolution before launch.

Maintain an auditable country-by-product compliance register

An effective cross-border register includes consumer country, product variant, contracting creditor, any intermediary, assignment arrangements, operative legal provisions, national application dates, required disclosures, permission status, regulator and responsible control owner. Attach approved advertising examples, test purchases, disclosure delivery logs, creditworthiness decisions and servicing procedures. When a business enters a new market, revisit scope before copying an established checkout. Monitor national CCD2 implementing laws, supervisory publications, relevant court decisions and changes in the supply chain. Do not infer that one EU-wide policy is legally complete simply because identical products are sold in several Member States. An independent legal review is appropriate where applicable-law questions remain unresolved.

Frequently asked questions

Related research

the BNPL compliance pillar ↗

BNPL Compliance Checklist ↗