By Christina Grigorian

On May 22, the Consumer Financial Protection Bureau (CFPB) released an interpretive rule (Rule) that subjects certain "buy now, pay later" (BNPL) providers to requirements set forth in the Truth in Lending Act's implementing regulations.1 For purposes of the Rule, the CFPB's position defines BNPL products as "closed-end loans payable in four or fewer installments without a finance charge, used to make purchases on credit."

The Rule is somewhat limited in its application. Importantly, it does not apply to BNPL products that are offered through the "merchant partner acquisition model," which the Rule generally defines as a program whereby "BNPL lenders typically establish contracts with online merchants to offer their BNPL product as a payment option on the merchant's website or mobile app checkout page." Rather, the Rule is limited to BNPL providers that issue "digital user accounts" to consumers to access credit products to purchase goods and services, which generally involves the following:

[C]onsumers use the BNPL lender's own website or mobile app directly to create a digital user account to access the BNPL product. Once activated by the provider, the consumer can use their digital user account through the BNPL website or mobile app to access credit and make purchases directly with partner merchants. For non-partner merchants, the BNPL lender enables the payment part of the credit process by issuing a single-use virtual card to the consumer, normally through an issuer processor and a bank partner. The consumer then typically has 24 hours to complete their purchase directly with the merchant, using the virtual card … [A] BNPL digital user account is activated when a consumer first accesses BNPL credit, similar to how a virtual card number for a traditional credit card account is issued … BNPL providers typically inform consumers of their "amount available to spend," similar to a credit limit for conventional credit cards … [Digital user accounts] are, effectively, digital replacements for conventional credit cards, and consumers use them in the same way as conventional credit cards.

According to the Rule, issuers of digital user accounts are "card issuers" because digital user accounts are "credit cards"; this assessment then permits the CFPB to determine that these BNPL providers of digital user accounts are "creditors" for purposes of Regulation Z.2 As noted by the CFPB, the term "credit card" is defined both in the Truth in Lending Act and Regulation Z to include "other credit devices" or "other single credit devices" used for the purpose of obtaining credit and is not limited to "a plastic or metal embossed physical card."3 Based on these interpretations, the Rule advances the position that digital user account providers are subject to Subpart B of Regulation Z, including regulatory provisions related to cost of credit disclosures and billing dispute resolutions.

Notably, the CFPB's announcement states that it is not required, under the federal Administrative Procedures Act (APA), to collect public comments related to the Rule. However, the agency has determined that it will accept public comments if received by August 1.


  • In support of the Rule's issuance, the commentary notes that 17 percent of US consumers with a credit record made at least one purchase using a BNPL product between February 2021 and February 2022. Relatedly, according to a May 2024 report by the Federal Reserve Bank of Boston, consumers' rate of use of BNPL products was 9.3 percent in October 2023; but two years earlier, it was just 6.6 percent.4 Given these numbers, it is clear that the adoption of BNPL products is compounding in the US consumer credit market. Retailers that do not yet offer such products should make near-term assessments about the use of such consumer credit providers and determine if there is a BNPL product that works best for the retailer and its consumer customers.
  • Note that, while certain summaries of the Rule suggest that it applies to all BNPL products, that is not the case given that the Rule's scope is limited to "digital user accounts"; to the extent a consumer is engaged in a "one-off" use of BNPL in connection with the purchase of a merchant's product or service that is not tied to his/her digital user account with the BNPL provider, such use is not subject to the Rule.
  • Retailers that offer such financing options should look closely at their agreement(s) with the BNPL issuer, especially with respect to the representations, warranties and limitations of liability found in such agreements. As a third-party agent or distributor of such products, retailers offering BNPL could be indirectly implicated in offering their customers financing products that do not comply with applicable law. Retailers offering BNPL should also engage in affirmative outreach with their BNPL provider to determine the steps the provider is undertaking in order to comply with the Rule.
  • Given that the CFPB's position with respect to the determinative definitions supporting the Rule is already set forth in Regulation Z (the federal regulations implementing the Truth in Lending Act), it has taken the position that no public comment is required (such that the Rule is not subject to the APA). However, the CFPB did suggest that, as a result of public comment, it may "make revisions to the interpretive rule at a later time as appropriate in light of feedback received." To that end, those interested in the components of the Rule should provide such feedback to the CFPB no later than August 1, 2024.

1 12 CFR Part 1026 (Regulation Z).
2 The applicable definition of "creditor" is set forth at 12 CFR 1026.2(a)(17)(iii). The Rule further notes that BNPL products are not "open-end credit" as defined at 12 CFR 1026.2(a)(20) or a "credit card account under an open-end (not home-secured) consumer credit plan" as defined at 12 CFR 1026.2(a)(15)(ii).
3 The definition of credit card is "any card, plate, or other single credit device that may be used from time to time to obtain credit." 12 CFR 1026.2(a)(15)(i). The CFPB believes that the term "other single credit device" in Regulation Z and a corresponding definition in the Truth in Lending Act as inclusive of a BNPL "digital user account that a customer can use through websites, mobile apps, browser extensions, or integration with merchant websites or mobile apps" to access BNPL credit.

To read The Katten Kattwalk | Issue 27, please click here.