On Wednesday 15 July 2026, a familiar piece of the online checkout stops being quite so light-touch.

Deferred Payment Credit, the interest-free lending model better known to consumers as buy now, pay later, will come within FCA regulation where it is provided by third-party lenders. The FCA has been preparing the ground for months. Its final rules were published in February. Its firm-facing BNPL page was updated again on 8 July. The message is no longer theoretical: regulation day is here.

For lenders, this is a direct perimeter change. From 15 July, a DPC lender entering into a regulated agreement will need the relevant consumer credit permissions or a temporary permission under the DPC Temporary Permissions Regime. The FCA says the TPR registration window is now closed, and it has published a register of firms with temporary permission.

For merchants, introducers, embedded finance platforms and credit brokers, the position is more subtle. The Government has decided that broking DPC agreements will be exempt from regulation. That does not make the checkout a compliance-free zone. It means the regulatory pressure will travel through different channels: lender oversight, customer journey design, financial promotions, data, complaints, vulnerable customer treatment, Consumer Duty expectations and, inevitably, commercial contracts.

That distinction matters.

The temptation will be to read the merchant exemption as a narrowing of risk. In practice, it may do the opposite for some distribution chains. Where the formal permission requirement sits with the lender, the lender will need confidence that the route to the customer is controlled. What is said at checkout? What is omitted? How prominent is the repayment information? Does the consumer understand that this is credit? Is the product being presented as a budgeting tool, an affordability workaround, or something almost invisible?

The FCA’s stated aims are not surprising, but they are broad. It wants DPC borrowers to receive information that helps them make effective, timely and informed decisions, to be lent to responsibly and affordably, and to receive appropriate support when they are in financial difficulty. Those are not just back-office obligations. They live in the customer journey.

That is where this change becomes especially relevant for Authorised Compliance Ltd’s market: credit brokers, lenders, ARs, IARs and firms building finance into digital sales journeys.

The new DPC regime is not an isolated reform. It sits alongside the FCA’s review of consumer credit financial promotions, published in April, in which the regulator proposed simplifying parts of CONC 3 and relying more heavily on the Consumer Duty’s consumer understanding outcome. The FCA is also looking again at how cost of credit information is presented, including whether representative APR, representative examples and the 51 percent threshold remain the right tools.

There is a common thread here. The FCA is moving away from the idea that compliance is achieved merely by showing the prescribed wording in the prescribed place. It is asking whether customers actually understand the decision in front of them.

That is a harder test. It is also a more commercially realistic one.

A checkout journey can be technically neat and still be poor from a conduct perspective. A disclosure can be present but functionally invisible. A credit option can be compliant in a narrow sense but designed so that the consumer notices convenience long before they notice obligation. This is the territory in which product, marketing, compliance and technology teams now need to speak the same language.

For lenders, the immediate work is practical. Permissions, TPR status, policies, creditworthiness assessments, arrears handling, complaints processes, customer communications, reporting and governance all need to align with the final rules. Firms already authorised for other consumer credit activities should not assume that DPC can simply be folded into existing processes without a proper gap analysis. The product may look small-ticket and frictionless, but the regulatory obligations are not imaginary.

For merchants and platforms, the work is different. If broking is exempt, the question becomes: what standards will the lender require of us, and can we prove that we meet them? Firms should expect stronger contractual controls, more scrutiny of scripts and web pages, more testing of customer understanding, and clearer escalation routes when complaints or vulnerability indicators arise.

For AR and IAR models, there is another layer. Principals should be wary of distributed journeys that involve finance options, embedded payment prompts or lead generation activity without a clear map of who is doing what. The AR regime has already taught the market one lesson repeatedly: the FCA expects principals to understand and monitor the real business being carried on, not just the version described in onboarding papers.

The same logic applies here. If an appointed representative, introducer or commercial partner is close to a customer journey that nudges, frames or routes consumers towards credit, the principal needs to understand the conduct risk. Exemption from one activity does not dissolve accountability for systems, controls and outcomes elsewhere.

There is also a technology point that should not be missed. BNPL grew because it made credit feel almost native to digital retail. The next phase will involve even more automation: eligibility checks, behavioural prompts, open banking signals, dynamic disclosures, AI-assisted servicing and automated arrears triage. The FCA’s recent language on smarter regulation, growth and technology is not anti-innovation. But it is clear that trust is part of the bargain.

That should encourage firms to document the choices behind the journey. Why is a disclosure placed there? What testing shows customers understand it? How are declined customers treated? What data is used in affordability assessment? What happens when a customer misses a payment? How does the firm detect repeated use, distress or vulnerability? Who reviews outcomes after launch?

These are not questions to park until the first supervisory query arrives.

The larger lesson from DPC regulation is that consumer credit is becoming less tolerant of ornamental compliance. A policy on the shelf, a standard disclosure and a legal perimeter opinion will not be enough if the real journey tells a different story.

Authorised Compliance Ltd works with firms that live in precisely this space: credit brokers, ARs, IARs, lenders and firms deciding whether their model needs direct authorisation, principal oversight or a more disciplined compliance framework. The immediate issue may be BNPL. The wider point is bigger. Credit distribution is being judged by what customers experience, not just by what firms intended.

From 15 July, the checkout becomes a regulated frontier. The firms that handle it well will treat that as a design challenge, a governance challenge and a commercial trust challenge. The firms that treat it as a footnote may find the FCA reads the page rather differently.

‍

Source note

Key sources used: FCA PS26/1 on regulation of Deferred Payment Credit, including regulation day and policy background. FCA firm page on regulating BNPL, updated 8 July 2026, including scope, TPR status, merchant broking exemption and FCA aims. FCA CP26/15 on reviewing consumer credit financial promotion rules. FCA speech by Sarah Pritchard, “Showing our workings: solving for growth, risk and trust”, published 8 July 2026. Authorised Compliance Ltd website pages on credit broking, AR and IAR support, and Consumer Duty support.
Sources: (fca.org.uk) (fca.org.uk) (fca.org.uk) (fca.org.uk) (authorisedcompliance.com)

‍