BNPL Compliance 2025: CFPB Enforcement Shift & UK Regulation Deadline
What Happened: Divergent Regulatory Paths for BNPL
In May 2025, the Consumer Financial Protection Bureau (CFPB) announced a significant shift in its enforcement approach toward Buy Now, Pay Later (BNPL) products. The Bureau stated it will not prioritize enforcement actions based on Truth in Lending (Regulation Z) requirements for BNPL loans, reallocating resources toward consumer threats affecting servicemen, veterans, and small businesses. The CFPB is also considering rescinding the BNPL rule entirely.
Meanwhile, across the Atlantic, the UK government has taken the opposite approach. Effective July 15, 2026, unregulated BNPL agreements will come under Financial Conduct Authority (FCA) regulation, extending consumer protections to this rapidly growing sector. The FCA will require authorization for BNPL providers, with a temporary permissions regime opening from May 15 to July 1, 2026, giving firms six months to apply for full authorization.
Why It Matters: Regulatory Uncertainty and Strategic Implications
These developments create a regulatory divergence with significant implications for global fintech companies operating in both markets. The CFPB's decision reflects a risk-based enforcement strategy that may reduce immediate compliance burdens for BNPL providers in the US, but creates uncertainty about long-term regulatory expectations. Organizations should verify current timelines as regulatory approaches may evolve.
The UK's approach aligns more closely with broader international trends toward regulating fintech innovations. BNPL providers operating in the UK will need to comply with Consumer Duty requirements, including:
- Clear upfront information disclosure
- Proportionate affordability checks before lending
- Support for customers in financial difficulty
- Access to the Financial Ombudsman Service for complaints
This regulatory expansion addresses concerns about the lack of protections for the 11 million UK adults using BNPL, particularly as the market has grown from £0.06 billion in 2017 to over £13 billion in 2024.
What Organizations Should Do: Actionable Compliance Steps
1. Assess Jurisdictional Requirements
Fintech companies must develop separate compliance strategies for US and UK markets. In the US, while immediate Truth in Lending enforcement may be deprioritized, other consumer protection regulations still apply. In the UK, the July 15, 2026 deadline creates a firm timeline for implementing FCA requirements.
2. Update Policies and Procedures
For UK operations, update lending policies to incorporate mandatory affordability checks and clear disclosure requirements. Review and revise terms of service to ensure compliance with Consumer Duty obligations. For US operations, maintain existing compliance frameworks while monitoring for potential rule changes.
3. Strengthen Risk Management
Implement robust monitoring systems to track regulatory developments in both jurisdictions. Consider integrating specialized compliance tools for AML/KYC requirements, which remain critical under both regulatory approaches. Platforms like AIGovHub provide real-time regulatory updates and vendor comparisons for tools like ComplyAdvantage and Sumsub to help organizations stay ahead of changing requirements.
4. Prepare for Authorization Processes
BNPL providers operating in the UK should prepare for the FCA authorization process well before the temporary permissions regime opens on May 15, 2026. This includes documenting compliance systems, conducting internal audits, and ensuring management accountability frameworks are in place.
5. Develop Agile Compliance Frameworks
The regulatory divergence between the US and UK highlights the need for flexible compliance approaches that can adapt to different jurisdictional requirements. Consider implementing modular compliance systems that can be configured based on specific market regulations.
Related Resources and Next Steps
The July 15, 2026 UK deadline provides a clear timeline for compliance preparation, but the evolving US regulatory landscape requires continuous monitoring. Fintech companies should:
- Establish cross-functional compliance teams to address both jurisdictions
- Conduct gap analyses against FCA requirements for UK operations
- Monitor CFPB announcements for potential rule changes in the US
- Consider how these developments might influence other markets where BNPL operates
For organizations navigating these complex requirements, AIGovHub's regulatory intelligence platform offers tools for tracking fintech regulatory deadlines and comparing compliance solutions. As regulatory approaches to emerging financial technologies continue to evolve, maintaining agile compliance frameworks will be essential for sustainable growth in the BNPL sector.
This content is for informational purposes only and does not constitute legal advice. Organizations should verify current regulatory timelines and requirements with qualified legal counsel.