BNPL Regulation and Compliance at State and Federal Levels

In September of this year, the CFPB issued a report “Buy Now, Pay Later: Market trends and consumer impacts” that reviews the consumer metrics, market metrics, consumer financial health, and associated risks of this industry. While there is no formal BNPL regulation in the U.S. today, this report provides insight into where it might be headed.

In a webinar featuring Alan Kaplinsky, Senior Counsel at Ballard Spahr, and Lisa Lanham, Partner at Ballard Spahr discussed the CFPB’s report and what it means for BNPL lenders today and in the future.

This recap includes insights from both the federal and state levels on various topics of BNPL regulation and compliance, including the current state of the industry and expectations for the future, concerns around consumer protection, data harvesting, and overextension, what’s next for the CFPB and State regulators, and how to get out ahead of regulatory scrutiny.

Table of Contents

Current state of BNPL industry and expectations for the future

The BNPL industry experienced rapid growth but has slowed in recent months

The BNPL industry has experienced rapid growth over the past few years. Between 2019 and 2021, the number of loans originated by BNPL lenders increased by 970% and the number of BNPL users almost quadrupled. 

But now, BNPL companies are facing headwinds from various directions—consumer spending is down, inflation is up, and existing loan quality and cost of funding is constrained as interest rates continue to rise.

Short and long-term expectations at the federal level for BNPL regulation

From a regulatory standpoint, we’ll likely see minimal changes from the CFPB within the next year. Many of the issues outlined in the CFPB’s report could only be solved through regulation, which is a lengthy process. 

As for the long-term? It depends on how long Director Chopra remains in office—the outcome of the 2024 presidential election could impact the industry in the future. Nonetheless, we can likely expect to see BNPL regulation issued before then, says Alan.

Short and long-term expectations at the state level for BNPL regulation

The BNPL market will likely continue to slow with the decrease in consumer spending—which is why states may be even more concerned about consumer protection, says Lisa. 

Consumers are more vulnerable in a down economy, and may not have the financial literacy to know if BNPL products are actually a good fit for them.

From the state level, we’ll likely see a more aggressive approach to consumer protection and more stringent requirements placed on providers of alternative credit products to safeguard consumers over the next few years.

It’s also important to note that states have existing regulatory frameworks to work within for BNPL products, so they can likely move faster on regulations than the CFPB or other federal regulators.

Consumer protection risks for BNPL products

In December of 2021, shortly after Rohit Chopra became the Director of the CFPB, he put out an inquiry to collect information from five BNPL companies—Affirm, Afterpay, Klarna, PayPal, and Zip—to better understand the risks and benefits of what he referred to as “fast-growing loans.”  

The goal of the inquiry was to illuminate the range of these consumer credit products and their underlying business practices. Up until this point, there hasn’t been a lot of information and visibility into data around BNPL. 

In its report, the Bureau called out three main areas of concern for consumer protection risks for BNPL products: discrete consumer harms, data harvesting, and overextension.  

Discrete consumer harms

Discrete consumer harms outlined in the CFPB’s report include a lack of clear disclosures of loan terms, a lack of clarity on how to file and resolve disputes, having only one means of repayment (autopay) for all loan payments, and late fees.

Lack of clear disclosures

As of today, there isn’t any BNPL regulation for standardized disclosures at the federal level.

“Throughout the report, it’s made clear by the CFPB that the lack of standardized disclosures may obscure the true nature of a product as a credit product and make important information about loan terms, including when and how these are assessed and payments are due, less accessible to the consumer, and therefore, more difficult to do comparison shopping.”

—Alan Kaplinsky, Ballard Spahr

However, the BNPL industry is constantly being compared to the credit card industry by the CFPB, which does have standardized and mandatory disclosures, such as the Truth in Lending Act (TILA) and the Credit Card Accountability Responsibility and Disclosure (CARD) Act.

For example, under TILA, you’re required to have a Schumer box that discloses the amount financed, total of payments, annual percentage rate (APR), late fees, etc. 

“Although they’re not subject to Regulation Z, BNPL lenders should provide, at the minimum, TILA disclosures and put it in a boxed form because, why not? What have you got to lose? There’s no finance charge and it’s a 0% APR so it’s supportive of the marketing, and I don’t see any reason not to do it.”

—Alan Kaplinsky, Ballard Spahr

On the state level, there are existing laws and regulations around disclosures for consumer finance products. What States are struggling with, explains Lisa, is which “box” does BNPL fall into?

In response to the CFPB’s market monitoring inquiry, 21 State Attorney Generals sent a joint letter to the CFPB in which they addressed concerns around discrete consumer harms from BNPL products, including:

• New and supposedly innovative financial products that promise to disrupt and democratize the industry but push consumers into cycles of debt and carry some of the same terms and features as other expensive and predatory financial products
• BNPL products are popular among younger consumers who are unfamiliar with navigating credit products and consumers who may already be struggling to make ends meet and cover their existing debt burdens
• Quick application approvals, no credit checks, no interest or fees, convenient payment schedules – all of which could be masking features that could contribute to long-term damage to consumer’s financial health

The letter also addresses concerns that aren’t mentioned in the CFPB’s report, such as “the apparent emerging relationships between BNPL providers and for-profit schools, including online boot camps and credentialing programs.”

States are expressly urging the CFPB to fully appreciate what’s going on with discrete consumer harms and are holding providers accountable to ensure they’re doing what they should be to protect consumers.

Dispute Resolutions

According to the CFPB, dispute resolution is the top-ranking BNPL-related complaint category in the Consumer Complaint Database.

For credit cards, under Regulation Z and TILA, there are protections against unauthorized use, the right of the cardholder to issue claims or defenses against the issuer, crediting of merchant funds, billing error resolution rules, and so on.

For the BNPL industry, there are no protections at the federal level that apply because it’s not a credit card product. Many BNPL products are not subject to closed-end disclosures since there’s generally no interest charged on the transactions payable in less than 4 installments.

The challenge with dispute resolution for BNPL products is that if consumers have issues with a merchant, they have to continue to make monthly payments before the dispute gets resolved.

On the State level, the State AGs brought up this exact issue in their letter to the Bureau, saying that “consumers may continue to be on the hook to repay their loans even if they purchase faulty merchandise or merchandise from a scam company.”

The State AGs expressly urged the CFPB to review the dispute resolution procedures and protections offered by BNPL providers, ensure that BNPL providers implement rigorous oversight policies, immediately take action to cancel loans associated with defective or returned merchandise or purchased through scam merchants, and end relationships with unscrupulous merchants.

“There are consumer protections available to folks using credit cards or more traditional products. If BNPL products are going to be offered, the states want to make sure it’s being managed in a way that’s beneficial to consumers.”

—Lisa Lanham, Ballard Spahr

If companies don’t have a process down for dispute resolution, you’ll see an increase in consumer complaints. When consumer complaints can’t get resolved quickly, they bubble up to the CFPB. At PerformLine, we often see companies trying to be proactive and leveraging technology to help as they scale, says John. 

Autopay

It is a requirement from BNPL issuers that payments are made automatically through a debit card, credit card, ACH, or prepaid card.

In its report, the CFPB noted that only one lender made it easy to remove autopay via a self-service online portal. Two lenders allow borrowers to do so by phone, and the other two prohibit the practice completely (i.e. consumers cannot turn autopay off).

According to the CFPB, consumer advocates have critiqued BNPL lenders for permitting payments via credit card, with concerns around hidden interest and overextension. 

Alan talked about using the term “interest-free” in BNPL marketing materials and cautioned lenders to tread lightly with this term as it might not always be true. Since consumers can pay their BNPL loans with a credit card (i.e. “pay credit with a credit”), consumers can still accrue interest fees from their credit cards if they don’t make their payments in time.

On the state level, regulators have been focused on unscrupulous debt collection practices, which include BNPL. 

Although debt collection was not addressed specifically in the letter to the CFPB, it doesn’t mean that it’s not on the states’ radar, says Lisa. 

“I always like to say that the states look to the CFPB as their lighthouse. What’s important to the CFPB is going to be important to your state. It’s always important to hear what’s coming from the Bureau and think about how this could impact your organization on a state level.”

—Lisa Lanham, Ballard Spahr

Late Fees

Late fees are an important part of BNPL income, says Alan. 

In 2021, there were 12% of BNPL borrowers with at least one late fee, late fees were charged to 7% of all loans, and 57% of late fee charges were collected.

In general, late fees must be reasonable and proportional. Under Regulation Z, the CFPB designated what the maximum late fee could be to provide a safe harbor for consumers—which doesn’t explicitly apply to BNPL loans. Because of this, BNPL lenders are not limited to the size of their late fees, and some BNPL issuers will even charge more than one late fee per missed payment. 

“Put simply, Buy Now, Pay Later can be compared to a credit card that incorporates informercial-style payment plans…  I’ve asked our staff to identify potential interpretive guidance or rules to issue with the goal of ensuring that Buy Now, Pay Later firms adhere to many of the baseline protections that Congress has already established for credit cards.”

—CFPB Director Chopra

Data harvesting concerns for BNPL products

On the federal level, Director Chopra is concerned about the use of data from BNPL products and that it can be used for discriminatory purposes, whether it’s intentional or not.

The CFPB is specifically concerned about the infinite amount of data collected from BNPL lenders’ proprietary apps that can be used to surreptitiously entice consumers into getting involved and making purchases that they shouldn’t make (i.e. dark patterns).

“Buy Now, Pay Later has mimicked parts of Big Tech’s surveillance model to harvest and monetize data in ways that banks and credit unions have typically avoided. Through their proprietary interfaces, Buy Now, Pay Later firms can use our data to determine what products we see through paid product placement. This opens up the door to digital dark patterns and even the potential to price products based on our behavior.”

—CFPB Director Chopra

On the state level, regulators are generally distrusting of aggregating consumer data because they can’t fathom how this information will be used.

“BNPL providers collect consumer data that is valuable for other companies that want to understand shopping behavior in order to target consumers for new products (dark patterns). Merchant partnerships, and merger and acquisition activity with banks and other financial service providers, may lead to consumer data being shared amongst a variety of companies in ways that consumers may not understand or expect. We recommend the CFPB inquire into provider privacy policies, as well as into how BNPL providers collect, use, sell, and protect consumer data.”

—Letter to the CFPB from the State AGs

“I expect the State AGs to be fairly active when trying to figure out whether or not there are issues with dark patterns and data harvesting of BNPL products,” says Lisa.

Overextension risks of BNPL products

There are 2 areas of overextension of credit that the CFPB is concerned about.

First is loan stacking, where the consumer takes multiple loans from multiple merchants and providers. Since this data isn’t furnished to credit bureaus, there’s no way for lenders to know if consumers are overextending themselves and taking out loans that they ultimately cannot repay.

The second is sustained usage, which is the risk that frequent BNPL usage may threaten borrowers’ ability to meet other, more pressing obligations such as rent, utilities, mortgages, auto loans, etc.

Alan specifically called out that the CFPB’s report found that consumers who are overextended will pay their BNPL loans before they’ll pay their larger obligations, which could lead to much greater consumer harm and injury. 

On the State level, the State AGs’ letter focused on credit reporting and overextension. The letter calls out how there’s no requirement for ATR (ability to repay) analysis for BNPL products.

Ultimately, consumers are committing themselves to payments that they can’t afford because the products allow them to do so.

If BNPL lenders were required to report to credit bureaus, the hope is that it will lead to more rigorous ATR analyses and would encourage lenders to be more responsible in their underwriting practices and making sure consumers are protected.

Both the federal and state regulators are concerned about overextension, which is why we’re seeing inquiries and increased scrutiny from both levels.

What’s next for the CFPB, State Regulators, and BNPL regulation?

On the federal level, don’t expect full-blown rulemaking, says Alan. 

The CFPB will likely use other tools in its arsenal to regulate BNPL products, such as:

• Use of existing authority: The CFPB may implement authority already available to the Bureau to subject companies to supervision and examination. 
• Larger participant rule: The CFPB may opt to create a larger participant rule subjecting larger BNPL companies to automatic supervision.
• Selective enforcement: The CFPB may look for specific companies that are engaged in egregious practices to take enforcement actions against and build authority that way.

“If you’re in the industry, do some things voluntarily [for compliance] that you don’t necessarily have to do, but that are going to be viewed positively by the CFPB.”

—Alan Kaplinsky, Ballard Spahr

Lisa suggested looking to California’s Department of Financial Protection and Innovation (DFPI) as an example of what to expect from the regulatory front for BNPL because they’ve been proactive in regulating and enforcing the industry, starting back in 2019.

At the State level, we can likely expect a few things for BNPL regulation:

• State AGs will be actively going after BNPL companies for unscrupulous practices that fall under existing regulatory frameworks
• State regulators will assess whether or not BNPL fits into an existing framework for regulatory compliance 
• New laws and regulations from states who don’t currently have the right level of legislation or enforcement for BNPL products

Proactive compliance is key for BNPL companies

While there’s no specific BNPL regulation today, there are existing frameworks both at the federal and state level for consumer-facing products that can be used to examine and enforce companies offering BNPL products. 

Compliance and legal teams should be proactive and build out processes now to prepare for inevitable BNPL regulation and get out ahead of regulatory scrutiny.

Especially as the market is shifting, there are opportunities to evolve products and marketing to consumers—but, you can’t do that effectively if you’re not taking a proactive approach to compliance, says John. 

“I always joke around that when I was a little kid, my parents would always say ‘you have an answer for everything,’ but that’s the way you have to think about these things. You should always find yourself in a position where you have an answer for everything. Compliance is super important. Having something is better than having nothing.“

—Lisa Lanham, Ballard Spahr

If you have any questions or concerns about your compliance program, check out Ballard Spahr’s resources or reach out to Alan or Lisa directly for a free consultation.

Get out ahead of BNPL regulation with PerformLine

Leading BNPL lenders are already using PerformLine’s omni-channel compliance monitoring solution to gain complete visibility into their merchants’ activities and protect against potential regulatory scrutiny from the CFPB and other regulators.

Learn more about how PerformLine can help your BNPL organization be proactive with compliance and get out ahead of regulatory scrutiny.