BNPL FCA Authorisation 2026/27: Requirements, Deadline and Application Guide

Buy Now Pay Later lending entered FCA regulation on 15 July 2026, bringing previously exempt Deferred Payment Credit into the UK consumer credit regime.

Third-party lenders providing regulated Deferred Payment Credit must now either hold the relevant FCA consumer credit permissions or operate under a valid temporary permission. Firms that do not have either cannot enter into new regulated DPC agreements and must obtain FCA authorisation before launching or resuming regulated lending.

Existing firms that entered the Deferred Payment Credit Temporary Permissions Regime have a limited period in which to move to full FCA authorisation. The transition should not be treated as a simple continuation of temporary permission. The FCA will assess whether the lender can satisfy the threshold conditions and comply with the wider regulatory framework on an ongoing basis, including creditworthiness, customer information, Consumer Duty, financial promotions, customers in financial difficulty, complaints, governance and systems and controls.

For lenders already operating under temporary permission, the priority is to prepare and submit a complete authorisation application within the applicable six-month window following Regulation Day. For new entrants outside the temporary regime, authorisation is required before regulated DPC lending can begin.

BNPL regulation at a glance

The commercial term BNPL is broader than the legal category of Deferred Payment Credit. Businesses should therefore confirm whether the specific product falls within DPC regulation rather than assuming that every instalment product is treated identically.

What is Deferred Payment Credit?

Deferred Payment Credit is the term used in the legislation and FCA rules for the previously exempt form of interest-free instalment credit brought into regulation in July 2026.

Broadly, the product is interest-free credit used to finance the purchase of goods or services and repayable in 12 or fewer instalments within a period of 12 months or less, where the relevant statutory conditions apply.

The new regime principally captures arrangements where a third-party lender provides the credit in connection with a merchant sale.

The legal structure matters.

A retailer that provides its own qualifying interest-free credit directly to customers can remain outside the new DPC regulatory perimeter where the applicable exemption is satisfied. By contrast, a separate lender financing the merchant transaction can be carrying on regulated consumer credit lending.

Businesses should therefore analyse the contractual structure rather than relying solely on how the product is marketed to customers.

Who now needs FCA authorisation for BNPL?

Third-party lenders entering into regulated DPC agreements require the relevant FCA consumer credit permission unless they have a valid temporary permission.

This applies from 15 July 2026.

A firm that does not currently hold the necessary consumer credit permissions and did not enter the Temporary Permissions Regime cannot lawfully begin making new regulated DPC loans before authorisation is granted.

Some firms already authorised for consumer credit activities may be able to add the relevant DPC lending activity through a Variation of Permission rather than applying for authorisation as an entirely new firm.

The correct route therefore depends on the lender’s existing FCA status.

An unauthorised fintech entering BNPL for the first time will generally require a new consumer credit authorisation. An existing authorised lender may require a permission review and potentially a Variation of Permission.

Are merchants offering BNPL regulated?

The new regime focuses primarily on third-party DPC lenders rather than ordinary merchants offering the payment option at checkout.

The FCA confirms that DPC agreements provided by third-party lenders are regulated where the statutory conditions are met. Merchant-provided own credit can remain exempt, and the broking of DPC agreements has also been exempted under the new framework.

This means a retailer displaying a third-party lender’s BNPL product at checkout does not automatically require consumer credit broking permission solely because of the DPC arrangement.

The structure nevertheless needs to be examined carefully where the merchant performs additional activities beyond simple introduction or where other forms of regulated credit are offered alongside DPC.

The exemption relates to the specific legal framework for DPC and should not be assumed to cover every consumer credit activity a merchant may carry on.

What was the BNPL Temporary Permissions Regime?

The Temporary Permissions Regime was created to allow eligible existing DPC lenders to continue operating after Regulation Day while moving into full FCA authorisation.

The notification period opened before regulation began and closed on 1 July 2026.

Eligibility was restricted. Firms generally needed to have been carrying on relevant DPC activity on 15 July 2025, satisfy the statutory notification conditions and complete the required temporary-permission registration process.

The TPR therefore was not an open route for any business that wanted to launch BNPL before regulation.

Its purpose was to provide continuity for qualifying existing businesses during the transition into regulation.

The registration window is now closed. Firms that did not obtain a temporary permission and do not already hold the relevant FCA permissions cannot enter into new regulated DPC agreements until they become authorised.

When must TPR firms apply for full FCA authorisation?

The Temporary Permissions Regime provides a six-month application window from Regulation Day for firms to seek the necessary full FCA permission.

With Regulation Day falling on 15 July 2026, TPR firms should work towards the January 2027 deadline applicable to their transition rather than treating temporary permission as an indefinite regulatory status.

The key practical point is that the deadline concerns the application for full authorisation, not necessarily the date on which the FCA must have completed its assessment.

A complete consumer credit authorisation application takes time to prepare.

The lender needs a regulatory business plan, governance framework, financial information, policies, customer journeys and operational evidence showing how it complies with the new rules.

A firm that waits until the end of the six-month window before preparing the application risks submitting an incomplete or weak case.

What happens if a firm missed the Temporary Permissions Regime?

The TPR registration window is closed.

A firm without the relevant existing consumer credit permission or valid DPC temporary permission cannot enter into new regulated DPC agreements.

The appropriate route is to obtain full FCA authorisation before commencing regulated lending.

This affects both firms that missed the notification deadline and businesses that were never eligible because they did not meet the statutory TPR criteria.

Existing DPC agreements entered into before Regulation Day remain subject to the applicable transitional treatment, but that does not allow an unauthorised lender to originate new regulated agreements after 15 July 2026.

For new entrants, the regulatory strategy should therefore be completed before launch.

Product design, underwriting, customer communications and technology should be built around the FCA regime rather than retrofitted after commercial launch.

What does the FCA assess in a BNPL authorisation application?

The FCA assesses whether the applicant satisfies and can continue to satisfy the threshold conditions and whether the business is ready to operate within the consumer credit regulatory framework.

The business model is central.

The application should explain the product, target customers, merchant relationships, lending journey, credit decisioning, repayment model, fees, arrears treatment, revenue model and the role of third-party technology or servicing providers.

The FCA will also assess governance, financial resources, senior management, compliance arrangements, financial crime controls, complaints, Consumer Duty, financial promotions and the lender’s ability to treat customers appropriately throughout the credit lifecycle.

The application should describe the business as it will actually operate.

Policies and procedures need to correspond with the technology, customer journey and underwriting approach rather than existing as generic documents that are disconnected from the product.

Creditworthiness and affordability

Responsible lending sits at the centre of the FCA framework.

DPC lenders must conduct appropriate creditworthiness assessments before entering regulated agreements, taking account of credit risk to the lender and the risk that the customer may be unable to make repayments without experiencing financial difficulty or other adverse consequences.

The assessment should be proportionate to the circumstances.

The FCA has deliberately avoided imposing one rigid underwriting model for every BNPL transaction because DPC products can differ substantially in value, frequency and customer use.

Proportionality does not mean the assessment can be superficial.

A lender needs a documented methodology explaining what information it considers, how risk is assessed, when further information is required and how the model deals with repeat borrowing or customers holding multiple agreements.

Automated decisioning should also be governed properly.

The firm should understand how the model works, test outcomes and monitor whether the underwriting approach continues to produce appropriate results.

Consumer Duty applies to regulated BNPL lenders

Regulated DPC lenders come within the FCA’s wider conduct framework, including Consumer Duty where applicable.

The Duty requires firms to act to deliver good outcomes for retail customers across products and services, price and value, consumer understanding and consumer support.

For BNPL lenders, this affects more than the credit agreement itself.

The firm should consider whether customers understand the nature of the borrowing, repayment dates, consequences of missed payments and the effect of taking multiple agreements.

The checkout journey is particularly important.

A product embedded seamlessly within an online purchase can make borrowing feel less significant than a conventional loan application. The lender should ensure convenience does not come at the expense of customer understanding.

The firm should also monitor outcomes after launch and identify whether particular customer groups experience higher arrears, repeated borrowing or other signs of harm.

Pre-contract information and customer understanding

Customers need clear information before entering a regulated DPC agreement.

The FCA’s approach reflects the characteristics of BNPL, where borrowing often takes place quickly during an online or in-store checkout journey.

The information should enable the customer to understand that they are entering a credit agreement, what they will repay, when payments fall due and the potential consequences of missing payments.

The regulatory objective is not served by placing technically correct information somewhere in a long digital journey if customers are unlikely to see or understand it.

Product teams, legal teams and compliance should therefore design disclosure together.

The customer interface should present the information in a way that fits the product while still supporting an informed borrowing decision.

Consumer testing can be useful where the lender needs evidence that communications are understood in practice.

Customers in financial difficulty

The FCA expects lenders to treat customers in arrears or financial difficulty with appropriate forbearance and support.

A BNPL lender therefore needs more than an automated collections process.

The firm should identify customers who may be experiencing difficulty, provide appropriate communication channels and consider suitable support according to the circumstances.

Systems should allow the lender to distinguish between an ordinary missed payment and signs of wider financial stress.

Collections strategies, account restrictions, repayment arrangements and communications should be designed around the FCA’s expectations for fair customer treatment.

This is also an area where management information matters.

The board and senior management should understand arrears levels, repeat missed payments, complaints and the outcomes of customers entering support processes.

Financial promotions

BNPL marketing and customer communications must comply with the applicable financial promotions framework.

Promotions should be clear, fair and not misleading and should present the credit product responsibly.

The risk is particularly relevant where BNPL is promoted as a frictionless payment option without appropriate context about the fact that the customer is borrowing.

Merchants and marketing partners can also create risk for the lender.

Even where the merchant itself benefits from a regulatory exemption in relation to DPC broking, the authorised lender remains responsible for ensuring its regulated arrangements and promotions comply with FCA requirements.

Affiliate campaigns, checkout messages, social media, influencer activity and merchant-created content should therefore sit within an appropriate financial promotions governance framework.

Approval, monitoring and withdrawal processes should be clear.

Governance and senior management

A fully authorised DPC lender needs governance proportionate to the size and complexity of the business.

The FCA will consider whether senior management has sufficient experience and capacity to oversee a regulated credit business and whether regulatory responsibilities are allocated clearly.

The board should receive meaningful information about credit outcomes, arrears, complaints, vulnerable customers, underwriting performance, merchant risk, financial crime and other material areas.

Where decisioning is heavily automated, management should still understand the logic and outcomes produced by the technology.

Responsibility cannot be delegated entirely to a software model or third-party provider.

Temporary permission should also be distinguished from full authorisation.

A firm whose only permission is a DPC temporary permission receives specific transitional treatment under the Senior Managers and Certification Regime during the TPR. The governance requirements for the fully authorised business should therefore be designed for the firm’s future permanent regulatory status rather than assuming the temporary regime sets the long-term standard.

Financial resources and forecasts

The FCA expects consumer credit firms to maintain adequate financial resources for the nature and scale of their business.

For a BNPL lender, this includes understanding how the lending book is funded, how losses and arrears affect the business and whether the firm can continue operating under stressed conditions.

The application should include credible financial information and forecasts aligned with the business plan.

Customer growth, transaction values, merchant expansion, credit losses, operating expenditure and funding assumptions should be internally consistent.

A lender projecting rapid growth should also demonstrate that governance, compliance, customer support and collections capacity can scale alongside the credit book.

The FCA will not assess financial resources in isolation from the operating model.

An aggressive growth forecast supported by limited staffing or weak funding arrangements can raise broader questions about whether the business is sustainable and well controlled.

Financial crime controls still matter

BNPL is a consumer credit product, but financial crime obligations remain important.

Digital onboarding, remote customer acquisition and merchant relationships can create identity fraud, account takeover, synthetic identity and other risks.

The lender should have proportionate customer verification, fraud detection and transaction-monitoring arrangements according to its model.

Merchant due diligence can also be relevant, particularly where merchants play a significant role in customer acquisition or where transaction patterns create elevated fraud risk.

Financial crime controls should work alongside credit underwriting rather than as completely separate systems.

A customer may present both credit risk and fraud risk, and inconsistent data between the two processes can create avoidable weaknesses.

The application should demonstrate that the firm understands these risks and has controls proportionate to its scale.

Complaints and the Financial Ombudsman Service

Regulation brings DPC lenders within a more formal complaints framework.

Eligible customers can refer unresolved complaints relating to regulated activities to the Financial Ombudsman Service.

Firms should therefore establish appropriate complaint-handling procedures, record complaints accurately and identify root causes rather than treating complaints solely as customer-service tickets.

Complaint data can reveal wider issues with underwriting, communications, merchant practices, collections or technology.

Senior management should receive meaningful complaint information and ensure recurring problems are addressed.

The reporting framework for complaints is also changing, with updated FCA complaints reporting arrangements applying from 2027.

Firms moving through the TPR should ensure their systems can capture the data needed for full authorisation and future regulatory reporting.

Does the Senior Managers and Certification Regime apply?

The position differs between temporary permission and full authorisation.

A firm whose only regulated activities arise from a DPC temporary permission is specifically treated as outside the SMCR firm classification during the temporary regime.

Where a firm already holds other Part 4A permissions, its existing SMCR status is assessed without treating the temporary DPC permission as an additional regulated activity for those transitional purposes.

This should not be confused with the long-term governance position.

Once a firm becomes fully authorised for regulated consumer credit activities, it needs to consider the applicable SMCR requirements for its permanent authorisation.

Firms should therefore design governance and senior-management arrangements with the future authorised business in mind rather than treating TPR exemptions as the permanent standard.

What documents should a BNPL authorisation application include?

The exact documents depend on the applicant and business model, but a substantial application normally requires a detailed regulatory business plan explaining the product, customer journey, merchant model, revenue, underwriting, repayment structure and governance.

The firm should also have documented creditworthiness and affordability arrangements, Consumer Duty framework, financial promotions controls, arrears and forbearance procedures, complaints processes, financial crime controls, risk management and compliance monitoring.

Financial forecasts should align with the expected lending book and operating model.

Where important services are outsourced, the application should explain the role of each provider and how the lender retains regulatory oversight.

The FCA should be able to understand the complete customer journey from merchant checkout through credit decision, agreement, repayment and any subsequent arrears or complaint.

A collection of generic policies is not a substitute for an integrated regulatory operating model.

Existing authorised consumer credit firms

Many established DPC lenders already hold FCA consumer credit permissions for other lending activities.

These firms may not need a completely new authorisation.

Instead, they should confirm whether their existing Part 4A permission covers the regulated DPC activity or whether a Variation of Permission is required.

The FCA will still expect the firm to demonstrate that its systems and controls comply with the DPC-specific rules.

Existing authorisation does not remove the need to adapt underwriting, disclosures, Consumer Duty monitoring, arrears processes and reporting where necessary.

The advantage is that the firm already has an established FCA regulatory framework.

The project becomes one of permission scope and implementation rather than building the entire authorisation framework from the beginning.

New BNPL businesses entering the market

A new entrant without relevant FCA consumer credit permission must obtain authorisation before making regulated DPC loans.

The TPR is no longer available to new firms.

Regulatory planning should therefore begin before commercial launch.

The business should establish the legal lender, funding model, merchant arrangements, credit decisioning, customer journey and compliance framework before submitting the FCA application.

Technology partnerships should also be structured carefully.

Using a third-party platform, lender infrastructure provider or merchant integration does not automatically remove the need for authorisation if the fintech itself is the legal lender carrying on the regulated credit activity.

The regulated entity and contractual responsibilities should be clear from the outset.

Can a business operate through an FCA-authorised lending partner?

Potentially.

A fintech can structure a product so that an authorised third-party lender provides the regulated credit while the fintech supplies technology, merchant integration or other services.

The regulatory outcome depends on the actual arrangement.

The fintech should not represent itself as the lender or perform regulated activities that fall outside its own permissions merely because an authorised institution sits somewhere within the structure.

Responsibility for underwriting, customer agreements, credit decisions, complaints and regulated lending should be allocated clearly.

The commercial model should also consider Consumer Duty responsibilities across the distribution chain.

A partnership model can be an efficient route to market, but the regulatory perimeter should be analysed before customer contracts and technology flows are finalised.

What should TPR firms do now?

Firms operating under temporary permission should treat full authorisation as an immediate project.

The first step is a gap assessment against the permanent FCA requirements.

This should review the lending model, creditworthiness methodology, Consumer Duty, customer information, financial promotions, arrears, complaints, governance, financial crime, data and regulatory reporting.

The firm should then prepare the regulatory business plan and supporting documentation around the business as it actually operates.

Any material control weaknesses should be addressed before submission where possible.

The temporary regime allows the business to continue during transition, but it does not lower the standard the FCA will apply when deciding whether to grant full permission.

A complete application gives the regulator a clearer basis to assess the firm and reduces avoidable information requests.

How Regulatory Counsel can help

Regulatory Counsel supports BNPL and Deferred Payment Credit firms through FCA authorisation, Variation of Permission and the transition from temporary permission to full regulation.

We assess the business model and determine which consumer credit permissions are required, whether the firm needs a new authorisation or Variation of Permission and what regulatory gaps need to be addressed before submission.

Our work can include the regulatory business plan, FCA application, governance framework, creditworthiness and affordability methodology, Consumer Duty, financial promotions, arrears and forbearance, complaints, financial crime, compliance monitoring, financial forecasts and supporting policies and procedures.

For firms already operating under temporary permission, we can undertake a focused gap assessment and manage the authorisation application through submission and FCA information requests.

For new entrants, we can review the regulatory structure before launch so that the lender, merchant relationships, technology providers and customer journey align with the permissions being sought.

Contact Regulatory Counsel to discuss BNPL FCA authorisation, a DPC Variation of Permission or transition from the Temporary Permissions Regime.