The answer depends on activity, not the business label
Regulation generally attaches obligations to activities and defined legal roles rather than to a company's marketing description. A bank granting credit may be the creditor. A specialist fintech may grant the same kind of credit without describing itself as a bank. A retailer may arrange finance offered by another entity, finance purchases directly, or simply introduce a customer to a third party. Those arrangements can create different requirements. Begin by drawing the contractual and operational relationships: who promises credit, who supplies funds or terms, who introduces the consumer, who signs the agreement, who owns receivables and who manages repayment. Determine the applicable statutory definitions before assigning compliance responsibilities.
Creditors and lenders
A person who grants or promises to grant credit may fall within a legal definition of creditor, but those definitions are not interchangeable between jurisdictions. Directive (EU) 2023/2225 defines creditor by the grant or promise of credit in the course of trade, business or profession. Its scope and national transposition still determine applicability to an individual transaction. UK firms proposing to conduct regulated consumer lending must assess Financial Services and Markets Act permissions and FCA rules, including exclusions and exemptions. In the United States, Regulation Z has its own definition of creditor, including conditions concerning regular extension of credit and the obligation's initial payee. A funding partner, loan purchaser or brand owner is not automatically the creditor under every legal instrument.
Credit brokers and intermediaries
Intermediaries can have their own regulatory obligations even if they never fund a loan. A credit intermediary may present or offer agreements, assist with pre-contractual administration or conclude agreements on a creditor's behalf, depending on the governing definition. UK credit broking is itself a regulated activity when its legal conditions are met. FCA materials distinguish full-permission and limited-permission routes for certain firms, but limited permission does not mean no regulation. Firms should examine whether introductions, comparison tools, sales scripts and application handoffs amount to regulated broking. The identity of the lender must not obscure the role of an intermediary, nor should a broker assume the creditor's rules automatically describe all of the broker's own duties.
Merchants and embedded-finance platforms
A merchant can act as an ordinary seller, a credit provider or a broker, sometimes through different journeys on the same website. The source of finance and contractual structure matter. A deferred-payment arrangement made by the supplier should be distinguished from credit offered by a separate third party. Under CCD2, certain supplier deferred-payment arrangements are excluded only when specified conditions are met; the relevant product facts and national law must be checked. An embedded-finance platform may control advertisements, comparison information, customer data collection or application screens without being the named creditor. Its direct regulatory position may differ from contractual duties it has agreed with the creditor. Neither a short repayment period nor a zero-interest description alone establishes an exclusion.
Servicers, collectors and outsourced technology
Different frameworks may regulate debt administration, collections, credit servicing and related activities separately. The fact that a third party handles customer messages or arrears does not alone make it the creditor. Equally, outsourcing does not automatically eliminate the creditor's own legal responsibilities. Map the function performed, the firm directing it, the rights exercised, customer-facing representations and any required permission. For digital providers, assess whether a company is merely a technical contractor or performs an activity regulated in that jurisdiction. Distinguish public-law obligations from obligations created by an outsourcing contract or service-level agreement. Both can matter operationally, but they have different legal origins.
A practical responsibility matrix
Build a matrix with one row for each legal entity and one column for each relevant lifecycle stage. Add the precise activity, statutory role, applicable jurisdiction, instrument, authorisation status where relevant, contract owner and evidence owner. For a consumer journey involving a merchant, broker, lender and servicer, record who approves marketing, issues required information, performs assessments, forms the agreement and responds to complaints. Mark uncertain classifications for review with links to official law and regulator guidance. Refresh the matrix after changing product terms, changing funders, entering new markets or adding a new distribution channel. The matrix documents a legal analysis; it does not replace that analysis.
Avoid broad claims about exemption or authorisation
An exemption may depend on who provides the credit, the nature of the agreement, the consumer's capacity, the charges, the term or other detailed statutory conditions. A firm may fall outside one credit regime while still facing advertising, data protection or other requirements. The UK FCA's published broker guidance, for example, sets out different circumstances for obtaining permission and cautions firms to determine their own regulatory position. For cross-border arrangements, analyse each jurisdiction separately. Record the date of the law and official guidance consulted, and avoid treating a regulatory consultation as a change already in effect.
Frequently asked questions
Are brokers regulated if they do not lend their own money?
They can be. Credit broking and intermediary activities may be independently regulated depending on local law and the specific activity.
Does a merchant automatically become a creditor by offering instalments?
No automatic conclusion follows from the label. Review who grants credit, contract terms and the exclusions and definitions in the applicable jurisdiction.
Can a lender outsource its compliance obligations?
Operational tasks can be outsourced, but the allocation of regulatory accountability must follow the applicable law; a service contract cannot simply override statutory responsibilities.
Primary sources
Directive (EU) 2023/2225 ↗FCA: consumer credit brokers ↗FCA: lenders and hirers ↗CFPB: Regulation Z definitions ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.