Buy-Now-Pay-Later (BNPL) products are taking center stage as a popular way for consumers to purchase goods or services now and pay for them over time through a short series of installments, often interest-free. Industry researchers have found that BNPL is especially attractive to younger Gen Z consumers, who increased their use of BNPL products from 6% in 2019 to 36% in 2021. Observers have also noted that BNPL provides a mechanism to serve consumers with subprime credit histories or those who are underbanked and underserved. With this growth, lawmakers and regulators, especially the Consumer Financial Protection Bureau (CFPB), have voiced concerns about BNPL, including that consumers may easily spend more than they can afford and rack up multiple BNPL purchases with varying payment schedules and payment terms.
What should you know if you are a bank, payment processor, fintech lender, or merchant currently involved in or looking to explore the BNPL wave? Based on our work with each of these stakeholders, and our extensive experiences in handling government enforcement investigations, we outline below the compliance management, consumer protection, and industry self-regulatory considerations that merchants and payments providers should take into account as they explore BNPL.
How Does BNPL Work?
Merchants make BNPL offers available to consumers at the point of sale as an option to pay for merchandise on the checkout screen. Consumers who opt to pay with BNPL are redirected to the BNPL provider, which shows a timeline for installment payment – for example, four payments at two-week intervals. The consumer confirms basic information (name, billing address, telephone number, and date of birth, for example) that enables the BNPL company to perform a soft inquiry on the consumer's credit for the purpose of verifying identity and preventing fraud. Once approved, the consumer agrees to the BNPL provider's terms and conditions and privacy policy, often presented as clickwrap, and provides a payment account that the provider can charge or debit in installments. After the consumer completes the transaction with the BNPL provider, the consumer is redirected back to the retailer's site for order confirmation. The consumer may receive two confirmation emails, one from the retailer and a second from the BNPL provider.
Merchants that sign up with BNPL providers allow the provider to take over payments and collections for the sale. While many BNPL offerings are interest-free, profitability for BNPL providers is driven largely by fees they charge to merchants. According to the CFPB, merchants pay between 3% and 6% of the purchase price – similar to interchange fees in credit card transactions – to BNPL providers and willingly do so because consumers often spend more and buy more with BNPL offers.
Many BNPL arrangements tie payment back to a credit or debit card provided by the consumer. This structure facilitates a smooth transaction and increases use, thereby strengthening the brand recognition of BNPL companies. Some BNPL solutions allow consumers to apply for a virtual card at the point of sale for the BNPL purchase; in some cases, consumers may be able to add the virtual card to their digital wallet (Samsung Pay, Apple Wallet, Google Wallet, etc.), thereby allowing those consumers to shop anywhere in installments regardless of whether the merchant offers a BNPL option. The increased issuance of virtual cards in the BNPL space may impact traditional card issuers and interchange.
As BNPL companies establish more mechanisms for funding short-term small-dollar loans, ACH debits from consumer accounts may become the prevailing form of repayment. Interest charged on these loans may be lower than that of some credit cards, thus making BNPL loan products even more appealing to buyers. Likely anticipating changes in how consumers choose to pay for goods and services and potential loss of revenue from card "swipes," banks and payment processors are looking for other ways to become part of the payment process. Some banks and processors are partnering with BNPL providers so that any merchant using the payment processor's services may offer BNPL installment payments to its customers. The major credit card networks have also devised their own BNPL products and offer them to banks, processors, fintechs, and digital wallet providers through apps that allow cardholders to apply for BNPL loans.
Regulatory Considerations
Existing state laws are not written to apply specifically to BNPL companies, but BNPL companies may fall under state licensing regimes for lenders and be subject to state laws prohibiting unfair, deceptive, or abusive acts or practices (UDAAP). The California Department of Financial Protection and Innovation (DFPI) takes this view. In 2020, the DFPI entered a sweep of settlements involving Sezzle, Zip (formerly known as QuadPay), Klarna, Afterpay, and other BNPL providers for providing services without a license. In addition to paying modest civil penalties, these companies were ordered to refund or credit fees paid to them by California residents and prohibited from providing loans or extensions of credit except pursuant to a license.
On the federal side, an array of existing laws may apply to BNPL offerings ranging from credit reporting and data privacy laws to traditional UDAAP. For example, as a form of credit, BNPL offerings may be subject to anti-discrimination provisions in the Equal Credit Opportunity Act (ECOA). To the extent BNPL lenders consult with credit reporting bureaus to check the credit of their borrowers, the consumer protections of the Fair Credit Reporting Act (FCRA) would come into play. BNPL offerings that provide open-ended credit may be subject to the Truth in Lending Act (TILA) or Military Lending Act (MLA), which impose rules on account opening, advertising, fee disclosures, resolving credit billing errors, and other requirements. Financial institutions and others that receive nonpublic personal information from a financial institution are subject to Gramm-Leach-Bliley Act (GLBA) provisions designed to protect and safeguard consumer financial privacy. Bank partners of BNPL companies that provide a credit account would need to ensure that privacy notices and practices are compliant with GLBA.
Whether the BNPL offering is defined as a payment service or a form of credit is important. Some lawmakers have specifically urged the CFPB to "take action" against BNPL providers that operate without oversight. In a letter sent to CFPB Director Rohit Chopra dated December 15, 2021, a group of six Democratic U.S. senators asserted that some BNPL companies deliberately structure their products to avoid consumer protection obligations under TILA or other lending laws, which apply to loans repayable in more than four installments or are subject to a finance charge. The letter also contrasted BNPL products with credit card products, noting that, unlike BNPL, credit cards have ability-to-repay principles, dispute resolution mechanisms, monthly statements, and reasonable penalty fees.
Retailers that offer BNPL programs may be exposed to some share of the responsibility and liability. According to the lawmakers writing to the CFPB, marketing through retailer web sites and apps contributes to misperceptions that the interest-free payment plans offered by their BNPL partners are truly no-cost or free. In the UK, where discussions have focused on bringing BNPL arrangements within the scope of consumer credit licensing regimes, point-of-sale merchants would likely be treated as consumer credit brokers. U.S. retailers involved in BNPL offerings should keep this possibility in mind, too. For more information about how BNPL is regulated in the UK, see this article from Bird & Bird.
Consumer Protection
The list of consumer protection concerns raised by lawmakers and regulators is long. According to witnesses at a November 2021 House Financial Services Committee hearing on BNPL programs, consumers may face late fees, fees for failed payments, payment rescheduling fees, account reactivation fees, or other fees charged by BNPL providers that may not be readily apparent. Another concern is that as more fintech firms compete in the BNPL space, competition will drive merchant fees down and shift costs to consumers to make up the difference. Whether fees paid by merchants might be passed through to consumers in the form of a surcharge or otherwise remains to be seen.
Many concerns rest on the assumed inability of consumers to manage their BNPL purchases due to the lack of consolidated account statements, varying repayment schedules, and the lack of information and standardized disclosures about late fees and the consequences of default. Consumers who take advantage of BNPL offers may not have the ability to repay, and the lack of any substantial credit underwriting processes may result in extending credit to those consumers who are exposed to overdraft fees when BNPL payments are automatically withdrawn from bank accounts.
These concerns might be addressed through industry standards and self-regulatory programs that focus on disclosures, account statements, and the distinct roles of retailers, BNPL providers, and banks in consumer engagement. However, enhanced government regulation seems likely to take hold. On December 16, 2021, the CFPB issued a series of orders to five of the largest BNPL companies to gather information about industry practices and examine concerns about consumers accumulating debt under BNPL programs. The CFPB also raised concerns that BNPL lenders are engaged in "regulatory arbitrage" such that they are not adequately evaluating consumer protection laws that apply to their products and not providing, for example, dispute resolution procedures.
A significant portion of the CFPB's orders explore data harvesting among BNPL providers, which have access to the purchase and payments history of customers. In seeking to understand any risks created by using the data for targeted offers and to sell advertising, the CFPB has asked for information about how BNPL companies collect and maintain data resulting from consumer use of a BNPL product and data about individual users of BNPL. Furthermore, the CFPB has asked BNPL companies how they use this data, whether they share it, and whether they use the data for targeted offers or to sell advertising.
Finally, BNPL arrangements raise complications within typical customer service touchpoints that may create consumer harms. For example, if a consumer needs to cancel or return an order, who should they contact? As between the retailer and the BNPL company, which one is responsible for issuing refunds? Which part is responsible for debt collection? Are there credit reporting implications for consumers who fail to pay on time? The CFPB is also looking into these and other issues.
Moving Ahead
As BNPL evolves and the regulatory climate heats up, companies exploring the service will need good legal counsel to provide guidance on the issues that need to be tackled. Depending on your role in a BNPL transaction, these issues may include:
- Development of compliance policies and procedures to structure and implement a BNPL program consistent with consumer protection laws and regulatory standards.
- Compliance with state lending and licensing requirements as applicable to a specific BNPL product.
- Appropriate contracts and negotiations with partners to fund, provide, and market BNPL offerings to consumers.
- Structuring of funds flow and credit terms.
- Consumer-facing terms and conditions for retailers, BNPL providers, and financial institutions.
- Review of marketing activities, enrollment flows, and customer service issues (cancellations, refunds, etc.) for BNPL offerings.
- Software and intellectual property licensing agreements for BNPL technology.
- Brand protection efforts for new BNPL products and services.
BNPL will continue to receive significant attention from lawmakers and regulators in the year ahead. Careful planning may help promote stable industry growth, which enhances the benefits to business and consumers.