Buy now, pay later regulations are shifting rapidly across every major market, and founders operating in this space need to track developments in the United States, European Union, United Kingdom, and Australia simultaneously. The short version: BNPL is moving from a regulatory gray area into formal consumer credit frameworks almost everywhere, with licensing requirements, affordability assessments, and consumer protection mandates becoming standard. In the US, federal enforcement has stalled after the CFPB indicated in March 2025 that it would rescind its interpretive rule classifying BNPL as credit cards, but New York State enacted landmark legislation requiring state licensing.
The EU’s Consumer Credit Directive 2 takes effect November 2026, Australia began requiring credit licenses in June 2025, and the UK will require FCA authorization starting July 2026. For a startup building BNPL functionality or partnering with BNPL providers, this patchwork means compliance strategies must be jurisdiction-specific. A fintech offering BNPL to German consumers faces different obligations than one serving Australian customers, even if the product works identically. This article breaks down the current regulatory landscape by region, explains what each framework requires, and identifies the practical implications for entrepreneurs deciding where and how to operate.
Table of Contents
- What Federal BNPL Rules Apply in the United States Right Now?
- New York’s Licensing Requirement Sets a State-Level Precedent
- How Will UK Regulation Change the BNPL Market?
- EU Consumer Credit Directive 2 Brings BNPL Into Formal Credit Regulation
- Australia’s Criminal Penalties Create Serious Compliance Stakes
- New Zealand Follows Australia’s Lead
- What Should Founders Prioritize for 2026 Compliance?
- Conclusion
What Federal BNPL Rules Apply in the United States Right Now?
The federal regulatory picture in the US is currently in flux. In May 2024, the Consumer Financial Protection Bureau issued an interpretive rule that would have classified bnpl loans as credit cards under Regulation Z, triggering Truth in lending Act requirements. That rule never took full effect. On May 6, 2025, the CFPB announced it would not prioritize enforcement of the rule, and in a March 26, 2025 court filing, the agency indicated its intent to revoke the rule entirely. The CFPB acknowledged that the rule should have been made through notice and comment rulemaking procedures rather than issued as an interpretive guidance.
This means BNPL providers operating nationally face no imminent federal credit card disclosure requirements, but the regulatory uncertainty creates its own challenges. The average yearly dollar value of BNPL loans grew to $848 in 2023 from $745 in 2022, a 14 percent increase according to a December 2025 CFPB study. This growth has kept BNPL on regulators’ radar, and future administrations could pursue rulemaking through proper channels. However, the absence of federal rules does not mean a free pass. State-level regulation is filling the gap, and startups cannot assume federal inaction translates to operational freedom everywhere in the country.
New York’s Licensing Requirement Sets a State-Level Precedent
New York enacted BNPL-specific legislation within its FY 2026 budget, adding Article 14-B to New York banking Law. The law requires BNPL providers to obtain a license from the New York Department of Financial Services before operating in the state. It also seeks to cap interest rates on certain BNPL loans consistent with existing New York usury limits. The effective date is six months after NYDFS promulgates implementing regulations, so the exact compliance deadline remains uncertain. startups offering BNPL to New York residents should monitor NYDFS rulemaking closely and budget for licensing costs and compliance infrastructure.
The licensing process typically involves application fees, background checks on principals, financial requirements, and ongoing reporting obligations. For founders, New York’s approach signals a likely pattern. Other large states may follow with their own licensing regimes, creating a compliance patchwork that increases operational costs. Companies serving customers in multiple states may find themselves managing half a dozen different licenses within a few years. This is the tradeoff: geographic reach versus compliance burden.
How Will UK Regulation Change the BNPL Market?
The UK government passed legislation on July 14, 2025 bringing deferred payment credit under Financial Conduct Authority oversight. Regulation begins July 15, 2026 for third-party lenders, and BNPL providers will require FCA authorization unless exempted. A Temporary Permissions Regime opens for registration between May and July 2026, allowing firms to continue operating while their full authorization applications are processed. The FCA will publish final rules in Q1 2026. Firms must comply with FCA handbook requirements on creditworthiness and affordability assessments under CONC 5.2A, as well as rules for dealing with customers in financial difficulties under CONC 7.
These are not abstract obligations. Affordability assessments require systems capable of evaluating whether a customer can repay without undue hardship. Financial difficulty protocols require trained staff and documented procedures. For startups already operating in the UK without FCA authorization, the timeline is tight. Building authorization-ready compliance programs from scratch takes months, and the FCA authorization process itself is lengthy. Firms that miss the TPR registration window face a choice between exiting the UK market or risking enforcement action.
EU Consumer Credit Directive 2 Brings BNPL Into Formal Credit Regulation
The EU’s Consumer Credit Directive 2 has a transposition deadline of November 20, 2025, with new measures taking effect from November 20, 2026. CCD2 explicitly classifies BNPL as credit, subjecting providers to licensing and registration requirements across member states. The directive expands scope to cover loans under 200 euros, short-term loans up to three months, and interest-free loans, categories previously excluded from consumer credit rules. Key requirements include creditworthiness assessments per European Banking Authority guidelines, a 14-day withdrawal period for consumers, compliance with national APR caps on late fees and interest, and the right to human intervention for automated credit rejections.
That last requirement has significant product implications: fully automated BNPL decisioning must include a mechanism for human review upon customer request. Implementation varies by member state. Germany published its draft implementation bill on June 23, 2025, while the Netherlands has enacted an explicit prohibition of BNPL for minors. Startups operating across multiple EU countries must track national transposition timelines and variations. A compliant product in Germany may not satisfy Dutch requirements if it permits minor users, for example.
Australia’s Criminal Penalties Create Serious Compliance Stakes
Australia’s regulatory approach stands out for its severity. The Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024 passed on December 10, 2024. From June 10, 2025, BNPL providers must hold an Australian Credit Licence and maintain membership in the Australian Financial Complaints Authority. The law creates a new category of regulated credit called Low-Cost Credit Contracts covering BNPL products. ASIC released Regulatory Guide 281 on May 8, 2025 providing detailed compliance guidance.
Draft regulations were released February 5, 2025 for industry consultation. Critically, unlicensed BNPL provision after the deadline constitutes a criminal offense with substantial fines and potential imprisonment. This is not a situation where a startup can operate first and seek forgiveness later. The criminal penalty framework means Australian BNPL operations require proper licensing before launch. For international startups considering Australian expansion, this represents a significant barrier to entry compared to markets with civil penalty structures.
New Zealand Follows Australia’s Lead
New Zealand introduced responsible lending obligations for BNPL providers in June 2025 through amendments to the Credit Contracts and Consumer Finance Act. The Trans-Tasman regulatory alignment makes sense given the integrated nature of the Australian and New Zealand markets, and several major BNPL providers operate in both countries.
For startups already compliant with Australian requirements, New Zealand compliance is incremental rather than requiring a completely separate framework. However, the responsible lending obligations still require documented affordability assessments and appropriate product design, so treating New Zealand as an automatic add-on would be a mistake.
What Should Founders Prioritize for 2026 Compliance?
The regulatory trajectory is clear: BNPL is becoming consumer credit everywhere that matters commercially. Founders building in this space should prioritize three things. First, conduct a jurisdiction-by-jurisdiction assessment of where your customers are located and what rules apply in each market.
Second, build compliance infrastructure that can scale across multiple regulatory frameworks, because bolt-on solutions for each new market will become unmanageable. Third, budget realistically for licensing fees, compliance staff, and legal counsel, as these costs are no longer optional for serious BNPL operations. The companies that thrive will be those that treat regulation as a competitive moat rather than an obstacle. Smaller players without resources to navigate complex licensing regimes will exit or consolidate, while well-capitalized startups that invest in compliance infrastructure early will face less competition in regulated markets.
Conclusion
BNPL regulation is converging globally toward mandatory licensing, affordability assessments, and consumer protection requirements. The US remains an outlier with uncertain federal rules but emerging state-level requirements. The EU, UK, and Australia all have defined timelines and detailed requirements taking effect between late 2025 and mid-2026.
For founders, the practical takeaway is that BNPL is no longer a regulatory arbitrage opportunity. Building a sustainable business in this space requires treating compliance as a core competency rather than an afterthought. The startups that invest in proper licensing, robust affordability frameworks, and jurisdiction-specific compliance programs will be positioned to capture market share as less prepared competitors struggle or exit.