The regulatory response to Buy Now Pay Later in Australia

Abstract

The Buy Now Pay Later (BNPL) industry has seen considerable growth over the last 15 years and, from 10 June 2025, BNPL products will be regulated as credit products. This article considers the likely effectiveness of the proposed regulation which will require BNPL providers to comply with responsible lending obligations, and notes the important role that the regulator, the Australian Securities and Investments Commission, will play in monitoring and guiding BNPL providers’ responses to responsible lending obligations to avoid harm to consumers. Because BNPL is regarded as ‘low risk’ in most circumstances, there is the possibility that providers will be able to avoid effective regulation.

The Buy Now Pay Later (BNPL) industry has seen considerable growth over the last 15 years, and from 10 June 2025 BNPL products will be regulated as credit products.

This article considers the likely effectiveness of the proposed regulation which will require BNPL providers to comply with responsible lending obligations, and notes the important role that the regulator, the Australian Securities and Investments Commission (ASIC) will play in monitoring and guiding BNPL providers’ responses to responsible lending obligations to avoid harm to consumers. Because BNPL is regarded as ‘low risk’ in most circumstances, there is the possibility that providers will be able to avoid effective regulation.

Buy Now Pay Later (BNPL) products have become a significant form of financial product available to consumers over the last 15 years, facilitating deferred payment for goods and services but allowing consumers to access those goods and services immediately. The BNPL industry seeks to differentiate itself from exploitative alternative credit providers such as payday lenders, arguing first that BNPL is not a credit product, and second that they are not targeting vulnerable low-income consumers, but are most likely to be utilised by mainstream consumers for reasons of convenience and without incurring fees or interest.

With new regulation due to come into force in June 2025, which will require BNPL providers to hold an Australian Credit Licence and comply with responsible lending obligations as well as general conduct obligations in relation to their products, there has been a recognition by government that the potential harms of BNPL products for some consumers do need to be addressed. This article focuses on the responsible lending obligations that will apply to BNPL providers.

The responsible lending obligations under part 3.2 of the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act’) apply to all credit providers in Australia and impose an obligation on credit providers to ensure a loan is not unsuitable for a borrower. Pursuant to ss 128–132 of the NCCP Act, a credit provider must consider the ability of the borrower to repay the loan and gather information that confirms the financial capacity of the consumer to meet the relevant loan commitments. Credit providers must also document the purposes of a loan because the proposed credit must satisfy the objectives and requirements of the borrower.

This article considers the nature of BNPL, as a relatively recent innovation in consumer credit, requiring a legislative response. This was the case previously in relation to small amount credit products such as payday loans and the article discusses the likely effectiveness of the responsible lending framework. This framework in part takes a principles-based regulatory approach and will rely on the regulator being able to engage in close dialogue with, and oversight of, regulated entities in order to be effective.

An aspect of BNPL contracts that poses potential harm for consumers in the absence of responsible lending obligations, is the fact that a consumer may have entered into a number of BNPL contracts without the BNPL provider having to make any enquiries to ascertain the size of the burden already being carried by the consumer. Where low-income consumers find themselves entering into multiple BNPL arrangements, they will be focused on using their income to meet debt repayments without any ability to instead save to pay for goods and services. A 2020 ASIC report ¹ found that within the 12-month period preceding the report, 20 per cent of the consumers surveyed had cut back on or gone without essentials such as meals in order to meet repayment obligations on BNPL loans, while 15 per cent of those surveyed had taken out an additional loan to meet their obligations. The BNPL industry responded to that report with the release of the Buy Now Pay Later Code in March 2021, recognising the need for consumer protection, particularly for vulnerable consumers. ² This voluntary code has been criticised, however, for placing the onus on consumers to self-identify as vulnerable and for not adequately addressing affordability and suitability requirements. ³

Notwithstanding the potential harms of BNPL, the regulatory response has been influenced by the perception of convenience for the majority of consumers in being able to buy goods and services immediately and pay for them over time, without incurring any cost for that facility. It is for this reason that the regulatory response to addressing the harms of BNPL appears to have been informed by the need to perform a ‘balancing act’ between protecting against the potential harms on the one hand, and the need to ‘maintain the competitive benefits of low cost credit contracts for consumers'. ⁴

The tension between financial inclusion and protecting against the harms of exploitative credit products

In Australia and around the world, there have arisen credit models such as payday loans which target low income, vulnerable people and have been a subject of concern. One feature of payday loans has been the generation of profits through rollover fees when borrowers default, and the consequence for vulnerable consumers has often been falling into debt spirals from which it is difficult to recover. ⁵ The fees attached to these products when expressed in terms of an annual percentage interest rate have also been astonishingly high, meaning that ‘the poor pay more’ for credit. ⁶ A recent report by ASIC has noted ongoing concerns with providers of Small Amount Credit Contracts (SACCs) such as payday loans, including ongoing issues with unsuitable credit contracts being provided to consumers. ⁷

Providers of alternative, non-mainstream credit products have argued that their products are necessary to address financial exclusion in the market. Financial exclusion is a lack of access to necessary and appropriate financial services, which can exacerbate disadvantage. ⁸ There are certainly arguments that in a modern consumerist society, where it is necessary to be able to access credit from time to time to meet expenses in order to live a ‘normal life’, products should be available to meet the needs of those excluded from mainstream financial products. ⁹ The trouble is that the alternative products in question tend not to be safe and affordable and do not address the market failure evidenced in financial exclusion. That market failure needs to be addressed by ensuring that safe and affordable credit products, tailored to meet people’s needs and not send them down the path of a debt spiral, are available. Harmful products on the other hand need to be subject to regulation to minimise or remove any harms.

Alternative credit models in the Australian context

As new forms of consumer credit have emerged in the market, regulators have had to respond to new challenges.

Regulatory responses to exploitative credit products such as payday loans, which entered the market in the 1990s, ¹⁰ have included bringing payday loans within the scope of the NCCP Act through imposing responsible lending obligations on SACCs explained in s 5 as being:

loans to consumers, where the credit provider is not an Authorised Deposit-taking Institution (ADI), of up to $2,000, where the term of the contract is between 16 days and 12 months. ¹¹

Payday lending is widely considered to be a harmful and exploitative form of credit which plunges consumers into a debt spiral where:

[r]eceiving credit becomes a way of holding on, for a little longer, to what had become normal and achieving a little continuity in the midst of lives characterised by instability and uncertainty. ¹²

While easily accessible and in some respects addressing lack of access to credit for low-income consumers, ¹³ a lack of responsible lending practices by payday lenders has been a major concern of regulators including in Australia where the ‘ludicrous and completely unrealistic estimates of a person’s expenditure’ ¹⁴ by payday lenders has been recognised. In response to concerns regarding the over indebtedness of consumers of SACCs, providers of SACCs are required to hold an Australian Credit Licence and are subject to the responsible lending obligations under s 129. That section requires licensees to assess a credit contract as unsuitable for a consumer if the consumer will be unable to comply with their financial obligations under the contract or could only comply with substantial hardship. Under Section 31A National Consumer Credit Code (schedule 1 to the NCCP Act), a SACC is subject to a cap of 20 per cent for the loan establishment fee, and a cap of 4 per cent per month (that is 48 per cent per annum) as a monthly fee, effectively the interest on the loan. It should be noted that this allows for a relatively high rate of interest, and means, for example, that a $2000 loan repayable over five months could attract charges (fees and interest) of up to $800. Following reforms in 2023, Regulation 28 LCA of the National Consumer Credit Protection Regulations 2010 (Cth) provides that payments under a SACC cannot exceed 10 per cent of a consumer’s available income during the repayment period.

The BNPL industry emerged in the mid-2010s and has seen considerable global growth in recent years but has not been regulated as a credit provider. The most significant Australian BNPL provider, Afterpay, was founded in Sydney in 2015, ¹⁵ and there are now a number of other active BNPL providers in Australia. ¹⁶ From 2017 to 2018, just over $3 billion worth of BNPL payments were processed in Australia; from 2019 to 2020, this amount had risen to over $9 billion ¹⁷ and, from 2022 to 2023, it had risen to $19 billion. ¹⁸ While 40 per cent of users of BNPL in Australia are in the 18 to 39 year age group, overall usage increased across age groups between 2019 and 2022. ¹⁹

The BNPL industry seeks to differentiate itself from exploitative credit providers such as payday lenders, arguing that they are not targeting vulnerable low-income consumers, but are most likely to be utilised by mainstream consumers who appreciate the convenience of their product and who will avoid any fees or interest by repaying on time.

The model enables consumers to purchase goods and services by paying only part of the purchase price and deferring payment of the balance in a series of instalments. The customer receives the goods or services immediately and the merchant is paid in full at the time of the initial transaction, by the BNPL provider. The consumer then pays the balance that they owe to the BNPL provider. ²⁰ The merchant pays a fee to the BNPL provider usually ranging from 2 per cent to 8 per cent of the sale cost. ²¹ According to a 2024 survey, 41 per cent of Australians utilised BNPL within a 6-month period in the lead up to 2024. ²²

In addition to earning profits through merchant fees, BNPL providers also make money through consumers defaulting on due payments. In the case of Afterpay, for ‘$40 plus’ purchases, each time a payment is late a $10 fee is charged, with further fees of up to $7 if the purchase remains unpaid after 7 days. ²³ Afterpay will pause a consumer’s account when they miss a payment to prevent debt spiralling, and claim that:

We’ve designed Afterpay to be completely different to traditional credit providers, so that our customers are never in a situation of high compounding interest and revolving debt. ²⁴

In terms of responsible lending, Afterpay provides for ‘instant approval’ claiming that it takes only five minutes to set up an account. ²⁵ The company does what is called a soft credit check, which is not shown on credit reports, into whether there are sufficient funds in the linked credit or debit account, and how much the consumer will need to repay on the purchase. ²⁶

While BNPL providers have not been subject to responsible lending obligations under the NCCP Act, they have been subject to ASIC’s product intervention power under s 1023D of the Corporations Act 2001 (Cth) by which ASIC can issue a product intervention order when it is satisfied that a product has resulted in, or will or is likely to cause, significant detriment to retail clients. Additionally, the design and distribution obligations under ss 994B and 994E of the Corporations Act 2001 require businesses to consider the appropriate target market and marketing and distribution mechanisms for products. Nevertheless, there has been no mechanism pursuant to which BNPL providers are required to assess loan suitability for individual borrowers.

BNPL providers argue that their product improves access to credit, however this benefit is outweighed where the product causes serious hardship for low income, vulnerable consumers. Where people are using BNPL products to fund groceries, dental work, car repairs, baby products, school uniforms and energy bills, ²⁷ it seems reasonable to suggest that the product may cause harm, and that government has a role to play in ensuring adequate welfare. Any credit accessed to pay for these essential items needs to be safe and affordable and not likely to exacerbate over-indebtedness for vulnerable consumers. While alternative models to ensure access to safe and affordable credit are beyond the scope of this article, strategies might include expanding corporate social responsibility programs of banks to work with community sector organisations to deliver such products, and by government investment in organisations offering such products. This article will focus however on the current regulatory response to BNPL to minimise harms, focusing on the responsible lending regime and its likely effectiveness.

Australia’s regulatory response to BNPL

The regulatory response to BPNL has been very much an attempt to balance protection of vulnerable consumers from harm, while not exacerbating financial exclusion or removing a product from the market which for many people is a safe and convenient way to pay for goods and services. ²⁸

Under the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Bill 2024 (Cth), which passed through the Senate in November 2024 and is due to come into effect on 10 June 2025, a new category of credit contract referred to as the Low Cost Credit Contract (LCCC) will be included in the NCCP Act, and LCCC providers will be required to hold an Australian Credit Licence. While licensees are required to adhere to both general conduct obligations and responsible lending obligations, there is to be a modified responsible lending framework which LCCC providers can elect to opt into, to ensure that obligations are proportionate to risk. If they do not opt into the modified responsible lending framework, they will be required to comply with the existing responsible lending framework. An LCCC will be defined as credit under a BNPL contract, and BNPL is defined as an arrangement under which a BNPL provider directly or indirectly pays a merchant some or all of the price for goods or services purchased by a consumer, where there is a contract between the BNPL provider and the consumer for the provision of credit in relation to the transaction.

LCCC providers are required to comply with existing responsible lending obligations as set out in s 129 of the NCCP Act, referred to above, or the modified responsible lending framework described as scaleable according to risk. The modified responsible lending framework seeks to ‘provide appropriate and proportionate protections to consumers who enter LCCCs, while maintaining the benefits of consumer access to these kinds of credit products.’ ²⁹ Under the modified framework, where credit is for $2000 or less, then the credit contract will be presumed to meet the consumer’s requirements and objectives. Further, an initial assessment of eligibility for credit up to a maximum credit limit will suffice for a period of two years up to that credit limit. This can be compared with the standard responsible lending obligations which, under s 128 of the NCCP Act, require the assessment as to suitability to be made within 90 days of the credit assistance being provided.

Both the existing responsible lending framework and the opt-in modified responsible lending framework involve a mix of prescriptive requirements alongside principles-based regulation which sets out broad principles to which regulated entities must adhere, but to some extent leaves the details of compliance to the regulated entity. The existing framework requires the regulated entity to make reasonable inquiries into the financial circumstances of the borrower to assess the suitability of the product for the borrower, and while there is guidance as to what needs to be included in reasonable inquiries, what will constitute reasonable inquiries is not strictly prescribed. Similarly, under the modified framework, guidance as to what will constitute reasonable inquiries is provided but with a view to tailoring the credit provider’s inquiry obligations based on risk of harm and reducing information gathering requirements where the target market is not risky. ³⁰ Under the new s 133BXB(b) of the NCCP Act, determining what will constitute reasonable steps in determining suitability under the modified framework requires taking into account factors such as the target market for the product, whether the consumer is financially vulnerable, and any procedures in place to reduce the risk of harm.

ASIC has now published a consultation paper regarding draft guidance on LCCC regulation ³¹ which includes guidance in relation to the s 133BXC(3) factors, namely that the factors should be considered holistically and weighted depending on the individual circumstances of a particular credit application. ³² A benefit of principles-based regulation is that it allows regulated entities to determine the ways in which they will satisfy the articulated principles thus encouraging creative and innovative solutions rather than tokenistic responses. ³³ However, for this form of regulation to be most effective the regulator needs to be actively engaged in ongoing dialogue with the regulated entities to support them to achieve desired outcomes. ³⁴ The regulator responsible for enforcement of the NCCP Act is ASIC, which has recently been heavily criticised for its lack of effectiveness in enforcing regulation and protecting consumers, due to ‘significant structural, resourcing and cultural issues.’ ³⁵ On the other hand, a study which examined and critiqued the supervision of responsible lending rules by ASIC from 2014 to 2017 found 93 actions during that period relating to breaches of the responsible lending obligations, with 40 of those relating to SACCs, suggesting that this was an enforcement priority for ASIC at the time. ³⁶ It is notable that, for 2024, ASIC set as one of its 12 enforcement priorities: ‘high-cost credit and predatory lending practices’ ³⁷ so this has continued to be an area of focus given the risk of consumer harm. Given the emphasis on balancing the perceived benefits of BNPL against the harms, and the decision to offer a modified and less stringent responsible lending obligation in the case of LCCCs, there is a possibility that LCCCs will be regarded as low risk and low priority. While consumers themselves might pursue complaints against BNPL providers through the free services of the Australian Financial Complaints Authority, ideally the regulator charged with oversight of the responsible lending regime would act to proactively protect consumers. A failure in this regard would negatively impact on the likely effectiveness of the regulatory approach to BNPL which will require an effective regulator that can work closely with BNPL providers to provide guidance and hold the providers to account in relation to their responses to the responsible lending framework or modified responsible lending framework. It will be too easy for BNPL providers to design very light touch inquiry protocols and avoid the consequences of making unsuitable loans under the civil penalty regime due to an under-resourced regulator.

Conclusion

Recognising the potential harms of BNPL products for vulnerable consumers, BNPL products are to be regulated as credit and BNPL providers will need to hold an Australian Credit Licence and comply with general conduct obligations and responsible lending obligations. This article has focused on the responsible lending regime, and the modified responsible lending framework that has been developed on an opt-in basis for LCCCs recognising that many consumers who access BNPL services are at low risk of harm.

Both the current responsible lending framework and the modified responsible lending framework take a principles-based approach, in that regulated entities need to undertake reasonable inquiries and take reasonable steps to assess the suitability of loans, but there is scope within that ‘reasonableness’ for regulated entities to craft their approaches to meet those requirements. The modified responsible lending framework is designed to explicitly allow regulated entities to craft their response on the basis of risk, so as to minimise regulatory burdens where there is little risk of harm.

The effectiveness of this approach will very much depend on the ability of the regulator, ASIC, to work with the BNPL providers to monitor and oversee their responses to responsible lending requirements. Failing this, there is a risk that BNPL products will continue to be used by vulnerable consumers in circumstances where they are both unsuitable and harmful, without consequence.