Strengthening the regulation of Buy Now Pay Later (BNPL) in Australia

By Kerensa Sneyd, Nicola Greenberg, Lauren McCarthy
ASIC Banking & Finance Financial Services

How much will really change, and what should the industry consider to prepare? 6 min read

As expected, increased regulation of the Buy Now Pay Later (BNPL) industry is becoming more likely following Treasury's release of the options paper, Regulating Buy Now, Pay Later in Australia (Options Paper).

In this Insight, we examine each of the three options laid out by Treasury and provide some guidance on what to expect next depending on whether you're a BNPL provider, industry player or investor.

Proposed options 

In the Options Paper, Treasury describes a 'looser regulatory environment' that exists around BNPL to acknowledge that some aspects of BNPL are regulated (eg under the consumer protection provisions of the Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act) and by the design and distribution obligations (DDO) regime in the Corporations Act), but are generally exempt from regulation as 'credit' under the National Consumer Credit Protection Act 2009 (Cth) (Credit Act). Many of the larger BNPL providers are also signatories to the voluntary Buy Now Pay Later Code of Practice (BNPL Industry Code).

So, how might this change? Treasury is undertaking public consultation on three options:

Option 1 – strengthening the BNPL Industry Code and introducing co-regulation.

This option proposes a co-regulation approach, whereby:

  • the Government would introduce a modified affordability obligation under the Credit Act for BNPL providers, without imposing a requirement to hold and maintain an Australian credit licence; and
  • the Australian Finance Industry Association (AFIA) would work with industry to strengthen the BNPL Industry Code (which mimics some of the key provisions in the Credit Act), with certain provisions enforceable by ASIC.

Option 2 – limited regulation under the Credit Act. 

This option proposes to apply some elements of the Credit Act to BNPL providers, including a modified licensing regime, with a reprieve from some of the more prescriptive elements of the responsible lending regime (such as the need to verify a customer's financial documentation and check that the BNPL product aligns with the customer's requirements and objectives).

This option also proposes to strengthen the BNPL Industry Code as described in Option 1.

Option 3 – full regulation under the Credit Act.

This option proposes to treat BNPL as a credit product regulated under the Credit Act, and the BNPL Industry Code would be revised to address industry-specific issues that are not considered within the scope of the Credit Act.

Some proposed changes mimic existing obligations for credit card products, such as a proposed prohibition on increasing a customer's credit limit without the customer's consent. Although it may seem disproportionate to subject BNPL providers to the same regulatory obligations as providers of higher-value, longer-term credit products, it's worth remembering that the responsible lending laws in the Credit Act are scalable. This means that for low-limit credit like BNPL, providers should be able to significantly scale down what is needed to satisfy these obligations.

What's next? 

Regardless of which becomes the preferred option, it is clear that BNPL providers will be expected to make some changes to how they sell, assess and service customers of BNPL products. We may also see the first exercise of ASIC's enforceable industry code designation power.

What happens next will depend on who you are, and how involved your business is in BNPL. To assist, we've prepared some brief summaries that highlight just what you need to know and how to prepare for the changes ahead.

I am…a BNPL provider, how can I get ready?

We expect most BNPL providers have closely monitored the former and current Government for cues to future regulatory change and will have a good understanding of how each of these options might impact their businesses.

Now is the time for BNPL providers to consider whether and how to engage with Treasury on the Options Paper, raise any further issues and start thinking about what implementation of any of these options might look like. To assist, we've set out the work that may arise if BNPL is regulated by the Credit Act or the BNPL Industry Code becomes a code enforceable by ASIC.

Customer assessment

All three options propose to strengthen the assessment of a customer's ability to afford a BNPL product, to address a concern that there may not always be adequate affordability checks undertaken on BNPL customers.

While the level of proposed assessment differs across the three options, at minimum it will require providers to complete some form of affordability check, and may also require verification of a customer's financial situation or their financial objectives.

Amendments to the Credit Act

If BNPL is regulated by the Credit Act then, in addition to complying with the responsible lending obligations and assuming no further modifications to the relevant obligations are made, BNPL providers would need to:

  • review their products to ensure the terms and conditions meet the form and content requirements of the National Credit Code;
  • update their systems and processes to accommodate documentation obligations under the Credit Act and the National Credit Code (eg provision of statements, rules around payments, fees and charges and general record-keeping obligations); and
  • prepare the necessary documentation to be licensed by ASIC. This will include a requirement to show the organisational competence to hold an Australian credit licence, and vetting responsible managers and fit and proper people.

As credit licensees, BNPL providers would need to implement processes to comply with ongoing obligations, including in relation to:

  • internal and external dispute resolution;
  • customer hardship;
  • compensation arrangements;
  • fee caps;
  • marketing rules;
  • the reportable situations regime; and
  • ASIC reporting obligations.

Some BNPL providers are already credit licensees, and will have systems and processes in place to comply with these obligations in respect of their regulated credit products. However, BNPL providers who are not currently credit licensees will need to consider how they will move to comply with these obligations in either the full Credit Act environment (option 3) or with the partial exemptions proposed by option 2.

BNPL Industry Code becomes an enforceable code and is strengthened

Compared with the obligations in the Credit Act, the BNPL Industry Code is significantly less prescriptive. However, this may give rise to some confusion regarding implementation. The language in the BNPL Industry Code is broad, reflecting the fact it's a set of standards that represent best practice and generally imposes less of a compliance burden on BNPL providers than the specific prohibitions and obligations in the Credit Act, although in some places the Code goes further. For example, clause 12.1 provides:

To make sure we are providing our customers with a product or service that meets their needs on an ongoing basis, we will review our BNPL Products and Services to make sure they remain suitable for them.

An obligation to ensure products and services remain suitable for the customer does not exist in the Credit Act. While there are aspects of the BNPL Industry Code that impose considerably broad obligations, there are also some gaps which may need to be addressed if the Code were to be the primary method of regulating BNPL. For example, issues raised in the Options Paper that are not currently covered by the BNPL Industry Code include:

  • product disclosure and warning disclosure requirements;
  • minimum standards regarding assessment processes;
  • minimum standards regarding hardship practices;
  • excessive consumer fees and charges, including default fees;
  • refund and chargeback processes;
  • advertising and marketing;
  • mitigating risk associated with scams, domestic violence, coercive control and financial abuse; and
  • ensuring participants' compliance with these requirements is adequate.

It's possible the BNPL Industry Code will be updated to include additional commitments to address these concerns.

I am…another industry player or investor, what do I need to know?

Looking at the recent headlines, it's easy to forget that credit regulation is not a new concept to many in the BNPL industry. The major BNPL providers identified in ASIC's 2020 industry review generally provide both regulated and unregulated products, so they already hold a credit license. Whichever option is preferred by the Government, existing credit licensees should be well positioned to leverage their existing Credit Act processes to comply with new BNPL-specific requirements in the Credit Act or the strengthened BNPL Industry Code.

Less affected will be those providers that voluntarily apply responsible lending obligations or equivalent when assessing customers for a BNPL product. Some banks that issue BNPL products, for example, do not currently rely on an exemption from the Credit Act. These providers may only experience limited additional regulatory burden, as they already have a credit licence with the necessary authorisations and systems and processes to support compliance with their licence obligations.

The same applies to strengthening the BNPL Industry Code. In March 2021, eight companies which at that time controlled 95% of the BNPL market, signed up to the Code. Those that are not Code signatories will need to look closely at the work involved to become 'Code compliant', and those that are will need to uplift to the standards in the strengthened Code.

Overall, we expect that the smaller providers will be most affected by any regulatory changes, and the cost of compliance may weigh heavily on management's minds, particularly given the medium-term economic outlook. Like any sector facing increased regulation, some consolidation may occur.

That said, the fact that the Government is consulting on increased regulation reinforces the success of the sector and conveys an expectation it will continue to perform strongly. Increased regulation may lead to new opportunities for product diversification, attract additional investment and facilitate more rapid innovation.

I am…curious, why wasn't BNPL regulated in the first place?

While BNPL is not 'regulated credit', it is generally accepted that it is a credit product. We used 'regulated credit' to refer to a credit product that is subject to the Credit Act. Providers of regulated credit must hold an Australian credit licence with relevant authorisations, and adhere to the mandatory obligations prescribed by the Credit Act, many of which are canvassed above.

One of the defining features of BNPL is that it's largely unregulated. Some BNPL providers also issue a separate regulated credit product but, as a general rule, the majority of BNPL products are structured to avoid regulation by the Credit Act. This allows providers to give consumers access to their products in a way that is faster and more flexible as they do not need to comply with the responsible lending obligations in the Credit Act.

Generally, BNPL providers rely on one of two exemptions from the definition of 'regulated credit' in the Credit Act:

  • the section 6(1) exemption, where the provision of credit is limited by the contract to a total period not exceeding 62 days and, for all non-ADIs, the maximum amount of credit fees or charges that may be provided for or imposed does not exceed 5% of the amount of credit, and the maximum amount of interest charges that may be imposed or provided for does not exceed an amount equal to the amount payable if the annual percentage rate was 24% per annum; or
  • the section 6(5) exemption, where a charge that is or may be made for providing the credit is periodic or an other fixed charge that does not vary according to the amount of credit that is provided, and falls below a threshold specified by the National Consumer Credit Protection Regulations.

Structuring a product in this way means that providers can be more flexible in the provision of credit and offer it to consumers who may not otherwise have been able to access, or wanted to access, regulated credit.





August 2018

ASIC committed to reviewing the structure of the BNPL industry and potential issues in the sector in its Corporate Plan 2018-22.1

November 2018

ASIC published the results of its first review into the BNPL industry.2

ASIC found there was room for improvement in the industry and some evidence of consumer harm, eg:

  • potentially unfair terms
  • cases of customer over-commitment
  • a lack of safeguards equivalent to the responsible lending framework.

However, ASIC concluded that the credit laws should not extend to BNPL products.

Instead, it suggested that a product intervention power should be introduced so ASIC could exercise jurisdiction over BNPL providers where there has been, or will be, 'significant detriment' to consumers. This would allow ASIC to intervene in the industry in a more flexible and 'much more targeted and more effective way'. 3


February 2019

Recommendations of the Senate Economics References Committee

The BNPL industry was examined as part of the Senate Economics References Committee 'inquiry into credit and financial products targeted at Australians at risk of financial hardship'. 4

With the support of the industry, the Committee agreed that ASIC should be granted the product intervention power and recommended that the BNPL industry develop a code of practice.

The Committee also recommended that ASIC consult with the Government on what regulatory framework is otherwise appropriate for the sector, noting:

'There is a clear role for regulators in ensuring that buy now pay later is subject to proper regulation that will provide consumers with the same protections they would enjoy with respect to products with a similar risk profile'.

April 2019

Product Intervention Power

Parliament granted ASIC the Product Intervention Power with the introduction of the Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019 (Cth). 

The power enables ASIC to make a range of orders if the 'significant detriment' threshold is reached—from directions or restrictions on the advertising of BNPL products to outright bans on their sale.

DDO Regime

The new laws also brought BNPL products within the scope of the DDO Regime, which will commence later this year. Under the DDO Regime, BNPL providers will need to:

  • carefully consider the target market for their products;
  • define the target market in a publicly available 'target market determination'; and
  • take steps to ensure their BNPL products are sold in a way that is consistent with that determination.
December 2019


In December 2019, AFIA announced it intended to develop an industry code of practice for BNPL providers. 5

AFIA's goal was to respond to ASIC's concerns and the Senate Economics References Committee report. The BNPL Code sets out best-practice standards for the sector.


During the pandemic, the attention shifted from BNPL products. In the background, the industry was busy preparing the BNPL Code and managing the impact of COVID-19. 

November 2020

ASIC published its follow up to the initial review, 6 and took a much closer look at consumer outcomes.

ASIC highlighted that some consumers are missing payments, paying missed payment fees and struggling to meet other financial commitments.

However, ASIC concluded that the regulatory developments underway— including the DDO regime and the BNPL Industry Code—will adequately address these concerns.


January 2021

Credit Act amended to give ASIC the power to identify provisions of industry coes of conduct as enforceable, and subject to civil penalties.

March 2021

BNPL Code came into force.

August 2021

Review of Australian Payment Systems Final Report released. The Review did not make any determination as to the regulation of BNPL.

October 2021

RBA released its conclusions paper of its Review of Retail Payments Regulation.

This included a consultation as to whether it is appropriate to require the removal of no-surcharge clauses from contracts between BNPL providers and merchants. These no-surcharge clauses prevent the cost of BNPL services from being passed onto consumers. The RBA concluded it ‘would be in the public interest and consistent with its mandate to promote competition and efficiency in the Australian payments system for BNPL providers to remove their no-surcharge rules’.

October 2021

Parliamentary Joint Committee on Corporations and Financial Services released a Mobile Payment and Digital Wallet Financial Services Report.

The Committee recommended that AFIA continue to monitor the effectiveness of the BNPL Industry Code and to ensure it is updated as and when necessary.

The Committee recommended that it consider an inquiry into the BNPL industry 18 months after the BNPL Industry Code came into effect. 

October 2021

DDO Regime came into force.


March 2022

AFIA released a report from the BNPL Code Compliance Committee on the first year of self-regulation. The report highlights that customer complaints to BNPL Industry Code-compliant members have been low.

November 2022

The Government released the Options Paper proposing three options for reform in the BNPL sector. These are:

  • introducing additional industry self-regulation, plus a new 'affordability test' requirement for BNPL products;
  • bringing BNPL partly into the Credit Act. Providers would be required to hold an Australian Credit Licence and follow responsible lending obligations, with a sliding 'unsuitability test' applied to products; or
  • bringing BNPL products completely into the ambit of the Credit Act, requiring compliance with the same rules as credit cards and other traditional debt products.


  1. ASIC's Corporate Plan 2018-22 | ASIC – Australian Securities and Investments Commission

  2. ASIC Report 600:

  3. 5.35-36 of the Senate Report below quoting Mr Michael Saadat, Senior Executive Leader, Deposit Takers, Credit and Insurers, ASIC, Committee Hansard, 24 January 2019, p.15

  4. See this page.


  6. ASIC Report 672: