New rules for BNPL – how CCD2 affects E-commerce

Do you offer BNPL at checkout today? If so, CCD2 applies — even where the service is interest-free, provided by a third party, or only involves late-payment fees. Read on to understand when BNPL in Europe becomes a regulated consumer credit, what this means for you as an online retailer, and the steps needed to avoid rising costs, licensing requirements, or the risk of unprofitability.

The EU’s updated Consumer Credit Directive (CCD2) represents a substantial reform of the credit market. For E-commerce providers offering “Buy Now, Pay Later” (BNPL), it brings new obligations and a need to reassess existing business models. Our financial regulatory lawyers help online retailers understand the implications of CCD2. CCD2 is also referred to as “CCD II”, “Consumer Credit Directive 2” and “the second Consumer Credit Directive”, meaning the same framework may be described using different terms.

CCD2 applies from 20 November 2026. The directive expands the scope of consumer credit rules and, once in force, will also cover interest-free and fee-free BNPL services — meaning many online retailers will be caught by extensive credit regulation, with narrow exemptions for certain short-term credits. In parallel with national implementation, reforms are underway in domestic credit regulation (including the repeal of the Act (2014:275) on certain activities involving consumer credit).

The Act on certain activities involving consumer credit will be repealed through specific legislation, while CCD2 will be implemented primarily via amendments to the Consumer Credit Act and the Act (2016:1024) on housing credit activities (renamed the Act on housing credit and certain other consumer credits). The Swedish Financial Supervisory Authority (FI) will act as the supervisory authority.

BNPL becomes a consumer credit under CCD2 — what to prepare

CCD2 classifies BNPL services as consumer credits. This means creditors — including online retailers offering BNPL — must meet requirements covering, among other things, pre-contractual information, creditworthiness assessment and the right of withdrawal.

To comply with the new rules, BNPL providers should:

• Ensure credit terms meet the requirements for clarity, transparency and intelligibility.
• Perform creditworthiness assessments in line with the Consumer Credit Act.
• Ensure all fees and interest terms remain within applicable national interest and total cost caps.
• Implement processes for pre-contractual information, including the standardised SECCI form (in Sweden often referred to as the SEKKI form).
• Ensure the consumer’s rights to withdraw and to receive complaints information are upheld.

In addition, Standard European Consumer Credit Information (SECCI) may need to be provided before the credit agreement is concluded at checkout. Referring only to general terms is not sufficient; there are prescriptive information requirements and the format must be standardised so consumers can easily compare between lenders.

Many current BNPL configurations were designed so that online retailers would not need to apply consumer credit regulation. As these offerings now fall under CCD2, retailers and third-party providers need to review how the proposition is structured — both legally and technically.

Practical consequences and the risk of sanctions

Breaches can result in penalty fines, injunctions and significant reputational damage. Supervision will cover how credits are marketed, the quality of credit assessments, how “pay later” is presented across distribution channels, and whether information is provided in good time. Risk mitigation therefore requires a coordinated approach to these areas.

Review marketing materials and banners:

• Ensure ads, landing pages and claims do not imply “free” or risk-free credit.
• Align messaging across campaigns, product pages and the checkout.
• Document credit assessments to demonstrate traceability during supervision.

Show warnings and total cost:

• Consumers must clearly see the APR and all other costs and charges before the agreement is concluded.
• Place SECCI close to the decision point, avoid “dark patterns”, and verify mobile readability.

Synchronise UX with rule requirements:

• Embed compliance at checkout through documented credit assessments, clear stepwise information panels and consistent terminology.
• Ensure any third-party widgets meet the requirements.
• Test and document user journeys before campaign launches.

Clear ownership must be established for the obligations introduced by the second Consumer Credit Directive, with responsibilities defined across Legal, Product and Marketing. Set a timetable through to 20 November 2026 and follow up with, for example, quarterly checks of marketing, checkout and credit assessments. Ensure decision traceability and documentation so you can demonstrate compliance during supervision.

National rules tighten standards — pressure on current BNPL models

A particular challenge is that CCD2 is implemented nationally, meaning certain provisions will differ between EU countries. For online retailers, the national Consumer Credit Act will continue to apply, including absolute caps on interest and total costs. BNPL models relying on fees for, for example, late payment or reminders may therefore need to be adjusted to avoid breaching these caps.

Over time, some fee-based BNPL configurations may become commercially unsustainable. Retailers should consider whether the current model should be retained, renegotiated or replaced with a different payment solution.

At the same time, creditworthiness requirements are increasing. Creditors must have access to reliable information and make a documented assessment of the consumer’s ability to repay. This necessitates integration with credit reference agencies and other third parties, supported by clear internal processes.

Ensuring compliance and future-proofing your BNPL service

CCD2 is not only about new formalities — it changes the rules that apply when you offer deferred payment. Even fee-free BNPL set-ups will fall under consumer credit rules and therefore require legal review.

To avoid legal risk and meet evolving expectations from supervisory authorities and consumers, retailers should act proactively. To meet the directive’s requirements, you should:

• Identify which of your existing payment solutions are in scope of CCD2.
• Analyse how pricing, fees and credit terms align with national total cost caps.
• Ensure consumer information is complete and provided at the right time.
• Document and update procedures for credit assessments, withdrawal rights and contractual information.
• Engage with your payment service providers and ensure their solutions are compatible with the new requirements.

For some retailers, one option is to partner with established lenders who already meet regulatory requirements, though such cooperation does not remove your own licensing obligations where your role amounts to credit intermediation under CCD2. Partnership can, however, streamline compliance (credit assessment, reporting, SECCI/SEKKI forms and contractual documentation), while the retailer remains responsible for marketing, pre-contractual information in its own channel and UX design. Other actors may need to limit the scope of their BNPL offering or choose to operate as credit intermediaries under their own licence, including adjusting business models to ensure services comply with the new rules.

At Morling Consulting, our financial regulatory lawyers help companies across Europe analyse and adapt their payment terms to new legal frameworks — including CCD2 and the Consumer Credit Act. We assist with model reviews, compliance checks and contract adjustments ahead of national transposition of the directive.