Directive (EU) 2023/
Our CCD2 requirements for lenders sets out the standard form and the Article 18 workflow, and bringing an existing loan origination system up to CCD2 covers the clocks and the cost model. This one keeps to deferred payment.
For a provider that has worked outside consumer credit law, most of the new obligations arrive as code: in the component it ships to merchants, and in the fintech platform behind it that takes the credit decision.
Which deferred-payment structures are in scope
Article 2(2)(h) keeps one exclusion for deferred payment, and all three of its conditions have to hold:
- the supplier gives the consumer time to pay for its own goods or services, without a third party offering credit
- the price carries no interest and no other charges, apart from limited late-payment charges imposed under national law
- the whole payment is made within 50 days of delivery
Large online sellers get a tighter test. Where the supplier is not a micro, small or medium-sized enterprise (SME) and sells at a distance online, the limit is 14 days, and a third party may neither offer nor purchase the credit.
Structure at checkout | Under Article 2(2)(h) |
|---|---|
Merchant's own deferred payment, interest-free, limited late charges, paid within 50 days | Excluded |
A BNPL provider grants the credit and the merchant presents it | In scope: a third party offers the credit |
Large online seller's own interest-free deferred payment within 14 days, receivables kept | Excluded |
The same seller, receivables sold to a finance company | In scope |
Interest, a fee beyond limited late charges, or a longer payment term | In scope |
Article 2(8) lets a Member State switch off four provisions, all advertising and documentation detail, for credit under EUR 200, interest-free credit without charges, or credit repaid within three months with insignificant charges. The assessment in Article 18 and the withdrawal right in Article 26 are not among them, and Article 43(2) bars circumventing the national rules through the way agreements are formulated.
The merchant in the middle
A merchant that presents or offers credit agreements for remuneration is a credit intermediary under Article 3(12), unless it merely introduces the consumer to the creditor. Where it acts in an ancillary capacity, Article 10(10) lifts the pre-contractual information duty from it and leaves the creditor responsible for the consumer receiving that information. The form therefore belongs in the provider's component, and for deferred payment it shows the goods and their cash price (Article 10(3)(f)), so the integration passes line items.
Article 37(1) puts creditors and credit intermediaries under admission, registration and supervision, and Article 37(3) lets a country exempt SME merchants acting as ancillary intermediaries from the first two. Article 38(a) makes an intermediary state its powers and whether it works exclusively with one or more creditors. Merchant onboarding therefore records, per country, each merchant's status and the statement the component shows.
The provider's code on the merchant's page
Checkout badges and buttons often run as the provider's code. Where they advertise credit, Article 8(1) requires a clear and prominent warning, "Caution! Borrowing money costs money" or equivalent wording. Once the message names an interest rate or any figure on the cost of credit, Article 8(2) adds the Article 8(3) standard information, which for deferred payment includes the cash price and any advance payment. Those figures change with every basket, so the component renders them from the provider's pricing.
Article 15 forbids inferring the consumer's agreement from default options, pre-ticked boxes included, and Article 17 forbids credit without a prior request and explicit agreement. Where the information reaches the consumer less than one day before they are bound, the normal case at checkout, Article 10(1) requires a reminder of the withdrawal right one to seven days after conclusion: one scheduled message per purchase.
A creditworthiness assessment at checkout speed
Article 18 applies to every agreement in scope, whatever the size of the basket. Article 18(3) scales the information to the nature, duration, value and risks of the credit, and recital 55 ties it to data minimisation, so a EUR 60 basket repaid over 30 days can rest on much less evidence than a car loan. It still needs a documented procedure and record (Article 18(4)), and the credit goes ahead only where the assessment shows the obligations are likely to be met (Article 18(6)).
The decision also has to outlive the checkout. Where it involves automated processing, the consumer may ask for human intervention, an explanation and a review (Article 18(8)), so each decision keeps a record a reviewer can read weeks later. A refusal reaches the consumer without delay (Article 18(9)), naming the database where one drove it (Article 19(6)), and Article 18(11) lets each country require a database check.
After the sale: returns, arrears and complaints
Per-purchase BNPL credit is usually linked credit under Article 3(20): it finances one specific purchase, and the creditor uses the merchant to market or conclude it. Three provisions tie it to the goods:
- a consumer who withdraws from the purchase under a Union-law right is no longer bound by the linked credit (Article 27(1))
- a return policy on goods with a full refund for more than 14 calendar days extends the credit's withdrawal period to match (Article 26(3))
- where goods are not delivered, delivered only in part or not in conformity, a consumer who gets no satisfaction from the merchant may pursue remedies against the creditor, on conditions each country sets (Article 27(2))
A refund at the merchant is therefore a credit event at the provider, and the integration needs refund messages, each merchant's return-policy length for the withdrawal clock, and a dispute status for complaints about the goods.
Late fees are where national choices bite. Article 35(1) requires reasonable forbearance, where appropriate, before enforcement starts. A country may require default charges to be no greater than the creditor's costs from the default (Article 35(3)), must cap any additional default charges it allows (Article 35(4)), and may prohibit or limit specific charges (Article 31(2)). The fee schedule becomes a table keyed by country, and collections gets a forbearance branch before any enforcement step.
Complaints and records
The directive's 50 articles set no deadline for answering a complaint. Articles 10(5)(o) and 21(1)(u) require information about out-of-court redress, and Article 40 requires access to alternative dispute resolution. In Poland the 2015 act on complaints handling by financial market entities, which covers payment institutions and lending institutions among others, sets 30 days, up to 60 in complex cases, and a missed deadline counts as the complaint resolved in the client's favour.
Article 18(4) requires the assessment to be documented and maintained without setting a period, and GDPR erasure gives way to legal obligations and legal claims (Article 17(3)(b) and (e)), so the period comes from national law.
Poland, a month before the date
The directive is addressed to the Member States (Article 50), and what applies from 20 November 2026 is each country's transposing law (Article 48). Poland's government bill, project UC82, was withdrawn in May 2026, and as at 9 October 2026 there is no bill transposing the directive before the Sejm and no transposing act in the 2026 Dziennik Ustaw. Until one is adopted, the 2011 consumer credit act applies, and its Article 4(1), point 1, excludes agreements under which the consumer pays no interest and no other costs, so interest-free deferred payment without charges stays outside it for now.
CCD2 is fully harmonised (Article 42(1)), so the Polish act may not diverge from it unless the directive provides otherwise. Of the regulatory choices listed in Article 42(2), those bearing on BNPL include Article 2(8) on small and interest-free credit, 8(8) on advertising, 18(11) on database checks, 31(2) and 35(3) and (4) on charges, and 37(3) on SME merchants. They belong in configuration, with no Polish values loaded yet.
Germany has already legislated: its transposing act was published on 18 May 2026 (BGBl. 2026 I Nr. 139), and its consumer credit rules, which bring in buy now, pay later models, enter into force in November 2026.
Lending platforms we have delivered
Bringing deferred payment under CCD2?
WislaCode builds regulated lending and payment software, from the decision service and its record to merchant integrations.
Which buy now, pay later models does CCD2 cover?
As a rule, CCD2 covers every model in which a third party offers the credit, and a merchant's own deferred payment that misses any condition of Article 2(2)(h). That exclusion covers only a supplier giving time to pay without a third party offering credit, with no interest or charges beyond limited late-payment charges, and with payment within 50 days of delivery, or 14 days for a large online seller.
When do the CCD2 rules for BNPL apply?
The rules apply from 20 November 2026, through each country's transposing law (Article 48). Germany published its act in May 2026. Poland had no transposing act as at 9 October 2026, and until it adopts one, its 2011 consumer credit act, which excludes credit free of interest and other costs, still applies.
Does a small BNPL purchase need a creditworthiness assessment?
Yes, where the agreement is in scope. Article 18 has no amount threshold, and the Article 2(8) option for credit under EUR 200 does not cover it. Article 18(3) scales the information to the nature, duration, value and risks of the credit, so a small, short purchase can rest on less data, documented under Article 18(4).
What happens to the credit when the customer returns the goods?
A consumer who withdraws from the purchase under a Union-law right is no longer bound by the linked credit agreement (Article 27(1)). A return policy on goods with a full refund for more than 14 calendar days extends the credit's withdrawal period to match (Article 26(3)). After withdrawing from the credit, the consumer repays the capital and accrued interest within 30 calendar days of sending notice, and owes nothing else apart from non-refundable charges paid to a public body (Article 26(5)).
Can a BNPL provider charge late fees under CCD2?
Yes, within national limits. A Member State may require default charges to be no greater than the creditor's costs from the default (Article 35(3)), must cap any additional default charges it allows (Article 35(4)), and may prohibit or limit specific charges (Article 31(2)). Article 35(1) also requires reasonable forbearance, where appropriate, before enforcement proceedings start.
How fast must a BNPL provider answer a complaint?
CCD2 sets no deadline. Articles 10(5)(o) and 21(1)(u) require the consumer to be told about any out-of-court complaint and redress mechanism, and Article 40 requires access to alternative dispute resolution. In Poland, the 2015 act on complaints handling by financial market entities sets 30 days, up to 60 in complex cases, and a missed deadline counts as the complaint resolved in the client's favour.