Buy Now, Pay Later in an Era of Increased Scrutiny and Economic Headwinds

ABA Risk and Compliance
By Michael R. Guerrero
March/April 2024

Reprinted with permission from the March/April 2024 issue of ABA Risk and Compliance.

After gaining popularity during the pandemic, Buy Now, Pay Later (BNPL) has become a ubiquitous form of credit used by millions of consumers to purchase goods and services, particularly in e-commerce transactions. In a typical BNPL transaction, a consumer will elect to finance a purchase of goods or services through a four-payment installment loan that carries no finance charges and typically requires the first payment to be made at the time of purchase.

While there is nothing new about using credit to finance goods or services, BNPL offers a streamlined, low cost, and low commitment experience that has attracted younger borrowers (borrowers under the age of 35 are more than twice as likely to use BNPL as those 65 or older),1 borrowers who want to manage cash flow or not impact their existing credit lines, and borrowers who want to avoid a hard credit check that might impact their credit scores. In 2021, the five largest BNPL lenders originated 180 million individual BNPL loans that totaled $24.2 billion.2 The average loan size was $135.3

The Evolution of BNPL

Consumers have had various tools over the years to acquire goods and services and pay for them over time. Seller-financed credit sales were at one point very popular. As were layaway arrangements. Some consumers turn to rent-to-own transactions. Longer-term, unsecured, interest-bearing installment loans are often used to purchase bigger ticket items. And, with $5 trillion in outstanding credit lines in 2022, credit cards continue to be the most prevalent form of credit that consumers use to finance goods or services.4 Notwithstanding the availability of these other options, BNPL has experienced explosive growth and popularity—between 2019 and 2021 the number of BNPL loans issued by the five largest lenders increased by nearly 1,000 percent.5

In the early days of BNPL, non-bank providers predominantly focused on establishing relationships with individual merchants and frequently focused on financing larger ticket items. The option to finance a purchase with BNPL credit would be presented in the merchant’s checkout experience alongside typical payment methods. Consumers electing to use BNPL financing would select the option during checkout, agree to loan terms, and make an initial payment to the provider.

Some providers structured their programs as “credit sales” where the merchant was the original creditor and then sold the obligation to the provider for a discount from its face value. Other providers structured their programs as loans entered into directly with consumers with the proceeds of the loan disbursed to the merchant on the consumer’s behalf, where the merchant would pay a fee to the provider in connection with each loan. From the consumer’s viewpoint, the credit sale and direct loan models may appear similar, yet they are subject to very different laws. This distinction, rooted in English common law, differentiates a credit sale from a loan. Notably, from the BNPL provider’s perspective, credit sales are more frequently exempt from state licensing requirements.

In 2020, the California Department of Business Oversight, now the Department of Financial Protection and Innovation, took action against a handful of BNPL providers who asserted their transactions were credit sales and required them to treat the transactions as loans subject to the state’s lending law. Today, nearly all BNPL transactions are structured as loans. As the BNPL industry found stable footing in the direct loan model, providers began to look for ways to acquire customers without having to rely on individual merchant relationships. Providers partnered with e-commerce platforms that managed the checkout experience for multiple different merchants, which allowed them to appear in the shopping carts of multiple merchants. This model, which is still prevalent today, is sometimes referred to as “BNPL 1.0” or the merchant-partner acquisition model.

As BNPL became more familiar to consumers, providers were better able to leverage their brands and relationships with consumers rather than rely on the consumers' relationships with merchants. Providers began to pre-approve consumers before transactions took place. Under this model, providers issue an "available to spend" and provide consumers with a single-use virtual card that can be used at nearly any merchant that accepts card payments. Loan proceeds are disbursed to merchants through the card network and providers are able to share in a portion of the interchange fees. Some BNPL providers have also created robust mobile applications that permit consumers to shop at various merchants within the BNPL provider's app. Under this model, providers may receive referral fees in addition to any merchant discount rate that they receive as part of the interchange fees. This model is sometimes referred to as "BNPL 2.0" or the app-driven acquisition model.

While BNPL started out as a non-bank product, banks have slowly started offering BNPL or BNPL-like products. Some banks offer these products in connection with existing products, such as credit cards. Some credit card plans permit consumers to make a purchase and then split it into installments on the back-end. Others allow consumer to choose to enter into installment plans for individual purchases before making such purchases. Some banks partner directly with merchants to offer BNPL plans to consumers and others partner with intermediary companies that help to connect consumers with merchants.

Regulatory and Compliance Considerations

Even though BNPL products are very cheap, with a zero percent interest rate, and of a short duration, the Consumer Financial Protection Bureau (CFPB) has expressed concern and identified areas that present risk of consumer harm.

Specifically, the CFPB has stated that it is concerned with:

  1. The lack of consumer protections or what the CFPB has called "regulatory arbitrage";
  2. Data harvesting and monetization; and
  3. Debt accumulation and overextension.6

In addition, as bank BNPL products are becoming more prevalent, the Office of the Comptroller of the Currency (OCC) recently issued a compliance bulletin “to assist banks in effectively managing risks associated with [BNPL] lending and in offering BNPL loans in a responsible manner.”7 The OCC echoed the CFPB’s concerns and also warned of risks associated with charges-offs, credit losses, fraud, and third-party risk management. Other areas of concern relate to unique issues that BNPL products present in connection with credit reporting and issues relating to merchant-related disputes.

Regulatory Arbitrage

BNPL loans with four payments and no finance charge are not subject to the federal Truth in Lending Act (TILA), which sets forth standardized disclosure requirements that enable consumers to easily determine the cost of credit, payment due dates, and default charges. The TILA also requires that these disclosures be given to consumers clearly and conspicuously, in a form that they can keep, and before consummation of the transaction. Because the TILA does not apply, providers have disclosed the terms of their products in various non-uniform ways. Some providers place their disclosures behind hyperlinks, other put them on their website in a "terms and conditions" section, and some provide them conspicuously when the consumer is consummating the transaction. Banks should carefully construct consumer user experiences to ensure consumers fully understand and agree to the terms of the transaction. If relying on an intermediary to connect consumers with the bank, the processes and manner in which the intermediary presents the bank’s disclosures should be carefully vetted.

"As BNPL became more familiar to consumers, providers were better able to leverage their brands and relationships with consumers rather than rely on the consumers' relationships with merchants."

Data Harvesting and Monetization

The CFPB has expressed concerns about the amount of data to which providers have access and stated that this threatens consumer privacy, security, and autonomy. Providers generally have access to consumer shopping habits, demographic data, psychographic, and behavioral data, which can be used to develop models, product features, and marketing campaigns to keep the consumer within the provider’s ecosystem and make them less likely to shop around for products or pricing outside of the system. The CFPB has expressed concern that this hampers competition and may result in consumers paying more for goods or services presented to the consumer by the provider. Banks should ensure that their data practices are clearly disclosed and that they are not used in a way that could cause consumer harm.

Overextension & Credit Reporting

Both the CFPB and the OCC have expressed concerns about underwriting processes used for BNPL products and consumers becoming overextended. This largely stems from the short-term nature of the BNPL product. Because the product is typically paid in full within six weeks of origination, it might not appear on a typical consumer report until the obligation has reached maturity. While the national credit reporting agencies (CRAs) have created BNPL solutions, these are generally ancillary to the consumer’s core file and have to be specifically requested.

More importantly, not all BNPL providers furnish information to CRAs. To compound the issue, not all providers obtain consumers reports on applicants. To the extent a credit check is conducted, providers frequently only make soft pulls that would not show up on a consumer report and some only check credit when the consumer obtains their first BNPL product with the provider. Providers then rely on their experiences with the consumer, and sometimes permit them to obtain larger loans after they have established a record of positive performance.

The result is a risk of “loan stacking.” This is where consumers might go to multiple different BNPL providers in a short period and obtain loans in a manner that potentially overextends themselves. Without any effective credit reporting or credit checks, providers are not able to track the number of BNPL loans that a consumer has outstanding. Likewise, a consumer’s economic situation could have changed and without proper underwriting the provider will not be aware of these changes.

Another risk relates to sustained usage, where a consumer might become overly dependent on BNPL products to the detriment of their other obligations. However, it is worth noting that BNPL credit is generally much less expensive than other forms of credit that consumers might turn to when in need, which should function to at least help mitigate some of these concerns.


The TILA establishes a robust disputes framework for credit cards, covering unauthorized use, billing errors, and merchant-related claims. In contrast, aside from the Federal Trade Commission’s “Holder Rule,” which when applicable permits a consumer to bring a merchant-related claim or defense against the provider, there is no structured framework for managing returns or consumer disputes. BNPL providers address disputes and returns in different ways, but disputes tend to be one of the top complaints relating to BNPL products. Issues arise when the return period extends beyond the term of the BNPL loan or when consumers are expected to keep making payments while disputes are being investigated. BNPL providers will be served well to have very clearly disclosed and accessible disputes and return policies.

Other Considerations

According to the OCC, providers, and particularly banks, may need to revisit their internal charge-off practices. While it is common for banks to charge-off unsecured debt after it has become 120 or 180 days past due, the short-term nature of the BNPL product might warrant charging the obligations off earlier. Likewise, the OCC expects banks to incorporate BNPL loans into their allowances for credit losses methodology. Third-party risk management is also an area of concern for the OCC. Banks that partner with third parties, including merchants, are expected to have effective third-party risk management practices.

What is ahead for BNPL?

The streamlined, low commitment, and low cost product has proven to be very appealing to consumers and merchants. This popularity, however, will continue to attract increased scrutiny. We have seen states take action and issue guidance relating to BNPL products (e.g., on January 17, 2024, a New York Senate Bill introduced the “Buy Now Pay Later Act”8). The CFPB continues to monitor the space, and now the OCC is weighing in. While BNPL appears to be here to stay, additional oversight and compliance expectations are likely to catch up with the recent growth.

Similarly, we can expect BNPL to continue to evolve. BNPL became ubiquitous while the cost of funds was extraordinarily low. In today’s rate environment and with increased competition, it would seem to be increasingly difficult to offer the four installment, zero percent interest rate, and minimal credit check product in a profitable manner. While some BNPL providers have begun to offer interest-bearing products with more robust underwriting, it seems likely that more will soon enter this space. For non-banks, this could mean exploring sponsorship programs with banks. There could be opportunities for bank in these sponsorships or in increasing their direct-to-consumer product offerings. While offerings attached to credit cards will continue to appeal to some consumers, there is a subset of customers who appear to prefer more discrete transactions. Now may be a good time for banks, with their already robust compliance management systems, to explore expanding their offerings in this market.

"According to the OCC, providers, and particularly banks, may need to revisit their internal charge-off practices. While it is common for banks to charge-off unsecured debt after it has become 120 or 180 days past due, the short-term nature of the BNPL product might warrant charging the obligations off earlier."

About the Author

Michael R. Guerrero is a Partner at Ballard Spahr LLP, where he co-leads the firms’ Fintech and Payment Solutions Team. His practice is focused on advising clients on product compliance considerations. He advises clients offering BNPL, point-of-sale and personal property financing and leasing, rent-to-own, credit card, and installment loan products. He is the former co-chair of the California Lawyers Association’s Consumer Financial Services Committee.

Prior to joining Ballard Spahr, Michael held in-house roles in the mortgage, debt purchasing, and fintech industries. While in-house, he helped to design, structure, and launch a 50 state BNPL product. Reach him at


1 Consumer Financial Protection Bureau, Consumer Use of Buy Now, Pay Later. Insights from the CFPB Making Ends Meet Survey (March 2023), available at: 03.pdf.  

2 Consumer Financial Protection Bureau, Buy Now, Pay Later: Market Trends and Consumer Impacts at page 31 (September 2022), available at:

3 Consumer Financial Protection Bureau, Buy Now, Pay Later: Market Trends and Consumer Impacts at page 31 (September 2022), available at: -

4 Consumer Financial Protection Bureau, The Consumer Credit Card Market at page 6 (October 2023), available at:

5 Consumer Financial Protection Bureau, Buy Now, Pay Later: Market Trends and Consumer Impacts at page 4 (September 2022), available at:

6 Consumer Financial Protection Bureau, Press Release: CFPB Study details the Rapid Growth of “Buy Now, Pay Later” Lending (September 2022), available at:

7 Office of the Comptroller of the Currency, OCC Bulleting 2023-37: Retail Lending-Risk Management of ‘Buy Now, Pay Later Lending (December 2023), available at:


Subscribe to Ballard Spahr Mailing Lists

Get the latest significant legal alerts, news, webinars, and insights that affect your industry.