Deferred payment is leaving the gray area: the CCD2 Directive brings it within the scope of consumer credit, and the Spanish draft bill proposes Bank of Spain authorization. We map your products, choose the right route and adapt creditworthiness checks, late-payment fees and checkout without slowing conversion.
Free consultation
We reply in under 24 hours
“Buy now, pay later” is no longer unregulated territory: CCD2 brings it within the scope of consumer credit, and the Spanish draft bill proposes an authorization requirement. Six workstreams to adapt your model without slowing conversion.
We analyze each deferred payment product against the new scope: what falls fully within it, what benefits from a lighter regime (small amounts, interest-free credit, short terms) and what can rely on the exclusion for the merchant’s own deferred payment. Everything else depends on that map.
Under the Spanish draft bill, only entities authorized by and registered with the Bank of Spain would be able to grant consumer credit on a professional basis. We prepare your positioning, the route (a new authorization or an existing license type) and the application file so your BNPL is ready in time.
BNPL sits between two worlds: payment services and credit. We design the architecture with a payment institution, an acquirer or a funding partner so that every piece is properly licensed.
We review terms and conditions, late-payment fees, pre-contractual information and pricing against the current Consumer Credit Agreements Law (LCCC) and the caps envisaged in the draft bill.
Advertising with warnings, creditworthiness checks at checkout, a withdrawal button and zero dark patterns: distance marketing of credit already has its own rules in force.
Documented creditworthiness assessments, evidence of the information provided, complaints handling and monitoring of the legislative process through to the final text and its implementing regulation.
BNPL provider, online store with its own deferred payment, gateway that adds financing or specialized vertical: the same “pay later” button can have four different legal classifications.
“You finance third-party purchases at checkout: you are the core target of CCD2 and of the reserved activity regime. Scope, creditworthiness, information and authorization: all of it applies to you.”
“If you defer payment yourself, at no cost and over a short term, you may fall outside the scope. But the exclusion is narrow and has nuances for large online sellers: the fit must be documented, not assumed.”
“A gateway that integrates BNPL combines two regimes: payment services (PSD2) and consumer credit (CCD2). The architecture of partners and licenses decides who is responsible for what.”
“Point-of-sale financing for high-value services is textbook consumer credit. The verticals that thought they were offering ‘payment facilities’ are the ones with the most to review.”
BNPL grew by taking advantage of the exclusions for interest-free and short-term credit. That space is closing: CCD2 applies from November 20, 2026, and the Spanish draft bill proposes prior authorization.
The business model has been hit at its root: classic BNPL sat outside Law 16/2011 because it was interest-free or short-term credit. CCD2 expressly brings those cases within scope, albeit with a lighter regime in specific cases. “We’re free” no longer means “we’re unregulated.”
The exceptions are narrow and technical: amounts under €200, genuinely free credit, deferrals of up to 3 months with insignificant charges, or the merchant’s own deferred payment at no cost and over a short term (with tougher conditions for large online sellers). Each product is checked one by one; the details decide. (Page reviewed in July 2026: the draft bill is still going through the legislative process.)
Late fees are no longer a silent business: capped late-payment fees, warnings in advertising, creditworthiness assessments even for small amounts, and cost caps. BNPL pricing gets redesigned now, or the supervisor will redesign it.
Application date of the new Consumer Credit Directive. Professional BNPL becomes a fully regulated activity: information, creditworthiness and conduct.
The envisaged reserved activity regime would require authorization by and registration with the Bank of Spain to grant consumer credit professionally, including BNPL, subject to exceptions.
Directive (EU) 2023/2673 has applied since June 19, 2026: withdrawal button, digital information and a ban on dark patterns at checkout.
A product-by-product analysis tells you what falls within scope, what benefits from a lighter regime and whether the reserved activity regime reaches you. With that map, adapting your checkout and pricing is no longer a gamble.
Buy now, pay later is deferred payment at the point of sale: splitting or postponing a purchase, usually interest-free for the customer, with revenue coming from the merchant or from fees. It grew outside the scope of consumer credit because the previous rules excluded interest-free credit and short deferrals.
The CCD2 Directive closes that gap: it expressly brings these products within the scope of consumer credit, on the reasoning that the risk of over-indebtedness does not depend on whether the credit carries interest.
Today, BNPL with no interest or fees usually operates outside Law 16/2011 and without a specific license (some operators rely on license types such as the financial credit establishment [EFC] or on structures with payment institutions).
That status quo has an expiry date: with CCD2 applying from November 20, 2026 and the reserved activity regime envisaged by the Spanish draft bill, lending professionally would require authorization by and registration with the Bank of Spain.
Four fronts: scope (deferred payment comes in as consumer credit), information (standardized information sheet, advertising with warnings, adequate explanations), creditworthiness (assessment of repayment capacity even for small amounts, proportionate to the product) and conduct (limits on late-payment fees, a ban on unsolicited sales, right of withdrawal).
The specific cases that the framework singles out for a lighter regime or for exclusion are narrow:
The fine print matters: the fit is decided product by product and is best documented in writing.
If you grant deferred payment to consumers as a business (third-party BNPL provider), the Spanish draft bill would place you within the reserved activity regime: authorization and registration. If you are a merchant that defers payment on its own sales on an ancillary basis, you may fall under the exclusion or exemption — but this needs to be verified, not assumed.
We have a dedicated page on the new lender authorization with the full map of who is covered.
The ones that redefine BNPL design: a documented and proportionate creditworthiness assessment, standardized pre-contractual information at checkout, advertising with warnings (“pay in 3 at no cost” will need context), limits on late-payment fees and the right of withdrawal. In addition, the cost caps envisaged in the draft bill (maximum APR [TAE] by segment) would constrain pricing.
Yes, even if you are not the one providing the financing. As a channel, you are responsible for advertising (checkout elements and product pages must comply with the rules on credit marketing), customer information and, depending on how you take part in selling the credit, the regime for intermediaries, whom CCD2 requires to be registered and supervised.
The practical solution: clear contracts with your BNPL provider on who is responsible for what, and a review of your funnel screens.
It is one of the most sensitive points: part of the industry quietly monetized late payments. The new framework limits fees for claiming overdue amounts (the draft bill envisages a cap) and requires full transparency on the costs of non-payment before the contract is signed.
If your bottom line depends on late fees, redesigning the model is not optional: it is urgent.
No. BNPL is usually a closed-end deferral tied to a purchase (3, 4 or more set installments), while a revolving card is an open-ended credit line that replenishes as it is repaid. That said, the new framework brings their obligations closer together: creditworthiness, information and cost limits apply to both, and a specific transitional cap is also envisaged for open-ended credit (22 points).
Yes: until CCD2 applies and the new Spanish law enters into force, the current framework governs. The key is to use this time: the timeline envisaged in the draft bill allows only 3 months from entry into force for the authorization regime, so the gap analysis and the application file should be prepared now, not after publication in the BOE.
It is the exclusion designed for merchants that offer payment facilities on their own sales: no interest or charges, a short term (around 50 days) and no third-party lender involved. CCD2 tightens it for large online sellers. If your “pay later” is operated by a third party, or you charge for it, this exclusion does not apply.
The creditworthiness assessment must be based on relevant and proportionate data, be documented and be explainable: fully automated decisions give the right to human intervention and an explanation. If you use AI models to decide in milliseconds, model governance (data, traceability, bias) becomes part of product compliance.
Cross-border lending to consumers in Spain is also subject to the new regime: the envisaged reserved activity regime would reach anyone who lends professionally in the Spanish market, whether or not they are established here. The best structure (subsidiary, branch, authorized license type) is decided with the regulatory map in front of you.
Since June 19, 2026, online financial contracting must include a withdrawal button or function as easy to use as signing up, pre-contractual information adapted to the medium and an interface free of dark patterns that push customers toward credit. In a BNPL checkout, this translates into specific screens: we review them one by one.
The same “pay later” button can be an exclusion, a lighter regime or fully regulated credit. This map summarizes the expected fit; the cost of adapting depends on which box you are in.
The effort depends on the gap between your current operations and the new framework, and on how many different products you offer.
A phased method to reach November 20, 2026 with your product adapted and, where applicable, your authorization application 80% complete.
| Model | Merchant’s own deferred payment | “Free” third-party BNPL | BNPL / financing with a cost | Traditional financing (EFC / bank) |
|---|---|---|---|---|
| Who provides the financing | The seller itself | Third-party BNPL provider | BNPL provider / lender | Supervised entity |
| Current regime | Outside consumer credit rules | Generally outside (interest-free credit) | LCCC applies if there is interest or charges | Fully regulated |
| With CCD2 + new law | Narrow exclusion: no cost, short term (~50 days), nuances for large online sellers | Within scope (lighter regime in specific cases) | Full consumer credit | Product and conduct adaptation |
| Bank of Spain authorization? | Probably not (check exemption) | Yes, unless an exception applies | Yes (reserved activity) | Already authorized |
| Key obligations | Document the fit within the exclusion | Information, proportionate creditworthiness checks, capped late fees | Full information, creditworthiness, cost caps, withdrawal | Caps, advertising, enhanced creditworthiness checks |
Indicative map based on Directive (EU) 2023/2225 and the Spanish draft bill of January 2026, both still pending transposition or completion of the legislative process. The final fit is decided product by product. Reviewed in July 2026.
The BNPL that survives 2026 will not be the one with the least regulation, but the one that has built it into the product without killing conversion. That balance is designed, not improvised.
Inventory every type of deferred payment and check it against the scope, the lighter regime and the exclusions. Without that map, any adaptation is done blind and any “we’re exempt” is a gamble.
Creditworthiness, information, late-payment fees and pricing are adapted while the authorization application is prepared, where applicable. The checkout is redesigned once, not twice.
Every screen must comply and convert: warnings that inform without destroying the funnel, a working withdrawal process and traceability of what the customer saw and accepted.
The starting point is the scope of the Consumer Credit Directive (CCD2) and the new lender authorization envisaged in the draft bill.
Adapting a BNPL is a project with four stops: product map, regulatory route, product and creditworthiness and funnel. Taken in order, conversion survives; improvised, the business grinds to a halt at the worst possible moment.
1) MapWithin scope, lighter regime or exclusion: the analysis is done product by product and in writing, because the exceptions are technical and narrow.
2) RouteThree ways to operate lawfully once the new regime applies. The choice depends on volume, control and timing.
3) ProductA creditworthiness assessment proportionate to the product and cost limits redefine the model: whatever cannot withstand the caps needs a redesign.
4) FunnelWarnings in “pay later” advertising, standardized information before signing up, a withdrawal button and zero dark patterns: each screen must comply with two sets of rules at once (CCD2 and distance marketing) without sinking conversion. This is achieved by designing screen by screen, with evidence of what was shown and accepted.
Quick decisionCCD2 scope and reserved activity: product map and authorization application, starting now.
If you defer payment yourself, at no cost and over a short term, you may be excluded: document the fit and review your advertising.
Structure with an authorized partner and contractual allocation of responsibilities for information and intermediation.
Product-by-product analysis against the CCD2 scope, the lighter regime and the exclusion for the merchant’s own deferred payment.
Fit report for each product type, signed and updated with every product change.
Assessment proportionate to the amount and the risk, documented, with traceability and explainability of automated decisions.
Lending policy, decision log and documentation of the scoring model.
Standardized information sheet, adequate explanations and advertising with warnings, including in the merchant’s materials.
Validated templates, versioned screens and a record of what was shown to each customer.
Capped late-payment fees, transparent total cost and pricing compatible with the envisaged caps.
Portfolio simulations, product sheets and product committee minutes.
Working withdrawal button, interface without dark patterns and digital contracting compliant with Directive 2023/2673.
Tested withdrawal flow, interface audit and evidence of consents.
All avoidable if they are caught at the mapping stage.
If you operate or offer deferred payment, these terms will shape your product in 2026–2027: they appear in CCD2, in the Spanish draft bill and in the distance marketing rules.
Deferral or splitting of payment at the point of sale, typically interest-free for the customer, with revenue from merchant fees or service charges.
Directive 2023/2225 extends the scope up to €100,000 and brings in interest-free credit and deferred payment, closing the routes through which BNPL grew without regulation.
Specific cases (amounts <€200, interest-free credit, deferrals ≤3 months with insignificant charges) to which a simplified regime may apply: within scope, with scaled-down obligations.
Narrow exclusion: the merchant defers payment on its own sales, with no interest or charges and over a short term (around 50 days), with no third-party lender and with tougher conditions for large online sellers.
The Spanish draft bill envisages that only entities authorized by and registered with the Bank of Spain may grant consumer credit professionally, which would cover BNPL outside the exceptions.
An obligation to assess repayment capacity using data that is relevant and proportionate to the product, documented and explainable — including when an automated model decides in milliseconds.
Credit advertising will require clear warnings about the cost and the consequences of non-payment, including in banners, product pages and merchant screens.
Limits on fees for claiming overdue amounts and full transparency on the cost of late payment before signing up. Models that monetize late fees need a redesign.
Since June 2026, Directive 2023/2673 has required a withdrawal function as accessible as signing up, adapted digital information and an interface without dark patterns.
Download our checklist to position your deferred payment business before deciding: license types available before the supervisor, a comparison of requirements, the stages of the application and common mistakes that delay authorization.
Tell us about your project and we will explain how to adapt your BNPL product to the new consumer credit framework without slowing conversion.
Buy now, pay later grew in Spain on the back of the exclusions in Law 16/2011: credit with no interest or charges and short-term deferrals fell outside the consumer credit regime. Directive (EU) 2023/2225 (CCD2), applicable from November 20, 2026, ends that era: it brings deferred payment and interest-free credit within scope, with a lighter regime for specific cases and a narrow exclusion for the merchant’s own deferred payment (no cost, short term and additional conditions for large online sellers).
The draft Consumer Credit Agreements Bill (anteproyecto, January 2026, still going through the legislative process) would add the missing piece: a reserved activity regime requiring authorization by and registration with the Bank of Spain for anyone who grants consumer credit professionally. BNPL providers operating as third-party lenders would be direct targets of this regime; merchants that defer payment on their own sales on an ancillary basis may be exempt, subject to verification of the fit.
The new framework requires a proportionate creditworthiness assessment even for small amounts, standardized information before signing up, advertising with warnings, limits on late-payment fees and the right of withdrawal. In parallel, Directive (EU) 2023/2673 on financial services contracts concluded at a distance — applicable since June 19, 2026 — requires a withdrawal function in the interface and bans dark patterns in the sign-up funnel.
The efficient sequence for a deferred payment operator: map your products against the scope and the exceptions, choose the route (lender authorization, existing license type or authorized partner), adapt creditworthiness, information, late-payment fees and pricing, and redesign the checkout in line with the distance marketing rules already in force. This page is reviewed at every milestone of the legislative process (last review: July 2026).