Retail Lending: Risk Management of 'Buy Now, Pay Later' Lending

Summary

The Office of the Comptroller of the Currency (OCC) is issuing this bulletin to assist banks¹ in effectively managing risks associated with "buy now, pay later" (BNPL) lending and in offering BNPL loans in a responsible manner. The OCC expects banks that offer BNPL loans to do so in a manner that is safe and sound, provides fair access to financial services, supports fair treatment of consumers, and complies with applicable laws and regulations. This bulletin is consistent with OCC support of bank efforts to meet evolving needs of consumers, businesses, and communities in a safe, sound, and fair manner.

"Buy now, pay later" is widely used to describe various types of installment lending products.² This bulletin addresses BNPL loans that are payable in four or fewer installments and carry no finance charges (i.e., the loans carry 0 percent interest and no other finance charges). Other characteristics of BNPL loans can vary. Loans with payment terms greater than four installments or that charge interest or carry other finance charges are treated as traditional installment loans (a longstanding bank product) and are therefore not within the scope of this bulletin.

Highlights

This bulletin

• provides background information on BNPL loans.
• discusses risks associated with BNPL lending.
• provides guidance to banks offering or considering offering BNPL loans.

Background

BNPL loans are also referred to as "point-of-sale installment loans" or "pay-in-4" loans. BNPL loan offerings have rapidly increased in recent years, and consumers are using BNPL loans for a diverse range of products and services. BNPL loans are a popular payment option, especially for online purchases. While BNPL loans' popularity continues to grow across all demographics, industry data suggest that the loans have gained rapid acceptance by tech-savvy younger generations and consumers with limited or no credit bureau history. If deployed and used responsibly, BNPL loans can provide consumers with a low-cost, short-term, small-dollar financing alternative to manage cash flow.

BNPL loans are often approved at the time of purchase, but some lenders approve BNPL loans before or after purchase. Additionally, some lenders require 25 percent of the total transaction paid at the time of purchase. In most cases, the 25 percent paid at purchase serves as the first payment.

Banks can contract directly with merchants to offer BNPL loans or go through a third-party BNPL provider that serves as an intermediary between merchants and lenders. Banks can also offer BNPL loans in-house without contracting with merchants or third parties. BNPL providers may facilitate low barriers to entry for banks because they have existing lending platforms, acquisition models, and servicing capabilities. As with all third-party relationships, a bank's relationship with a merchant or a third-party BNPL provider should be subject to effective third-party risk management.³

In a typical BNPL transaction, the lender pays the merchant for the good or service and takes on the responsibility of granting credit and collecting payments from the borrower.⁴ In their role as payment processor and lender, BNPL lenders assume borrower default risk. To compensate for the risk, merchants charge lenders a discounted amount of the full purchase price of the good or service. The lender then collects the full purchase price through installment payments from the borrower. The difference between the discounted amount of the purchase price and total installment payments is the lender's primary source of revenue from BNPL transactions. Payments are generally made automatically from the borrower's debit card, credit card, or checking account. If the borrower does not pay on time, the lender may, for example, charge late fees and refuse to make additional BNPL loans to the borrower until the borrower brings the account current.

The rapidly growing availability of BNPL loans could pose risks related to consumer credit reporting. BNPL loans may not be fully captured in borrower credit histories. Many BNPL lenders use soft credit bureau inquiries⁵ to approve borrowers. Existing credit scoring systems are not designed to capture the very short-term nature and structure of BNPL loans. Incomplete reporting of BNPL loans could make it difficult for lenders to know the total dollar amount of debts and other obligations that applicants have before determining whether to approve them for new credit. The three major credit bureaus announced they would begin including BNPL transactions in their reporting, but it could take some time before BNPL activity is consistently reflected in credit scores.

Risks Associated With BNPL Lending

When used responsibly and offered in a transparent manner, BNPL loans can support consumers' overall financial capabilities by providing a convenient and relatively low-cost option compared with alternative financing. Nevertheless, BNPL lending carries risks for banks and consumers. BNPL lending can result in credit, compliance, operational, strategic, and reputation risks to banks. Risks to banks and consumers include the following:

• Borrowers could overextend themselves or may not fully understand BNPL loan repayment obligations.
• BNPL applicants might have limited or no credit history, which could present underwriting challenges to banks.
• The lack of clear, standardized disclosure language could obscure the true nature of the loan, result in consumer harm, or present potential risks of violating prohibitions on unfair, deceptive, or abusive acts or practices.
• Merchandise returns and merchant disputes can be problematic for BNPL borrowers and banks because the issue may not be resolved during the brief term of the loan.
• Third-party relationships may increase a bank's exposure to operational and compliance risks because the bank may not have direct control of the activity performed by the third party.
• The highly automated nature of BNPL lending, with instantaneous credit decisioning and frequent strong reliance on third parties, may present elevated operational risk, including fraud risk.
• BNPL structures may present elevated first payment default risk from fraud or borrower oversight. With loan payments typically tied to a debit or credit card, overextension can also result in secondary fees charged to the borrower, such as overdraft, non-sufficient funds, and late fees.
• Lenders could have no visibility into an applicant's borrowing activity on BNPL platforms given limited capture of BNPL activity by credit reporting agencies.

Guidance

Banks engaging in BNPL lending should do so within a risk management system that is commensurate with associated risks. Risk management systems should be designed to capture the unique characteristics and risks of BNPL loans. Banks should maintain underwriting, repayment terms, pricing, and safeguards that minimize adverse customer outcomes and should ensure that marketing materials and disclosures are clear and conspicuous. Comprehensive and consistent credit bureau reporting that complies with the requirements of the Fair Credit Reporting Act and its implementing regulations helps banks manage credit risk and would allow borrowers who make on-time payments to demonstrate positive credit behavior and build credit history. Bank management should also consider the bank's strategic plan and risk appetite when making the decision to engage in BNPL lending.

In conjunction with this bulletin, bank management should also refer to OCC Bulletin 2020-54, "Small-Dollar Lending: Interagency Lending Principles for Offering Responsible Small-Dollar Loans," OCC Bulletin 2017-43, "New, Modified, or Expanded Bank Products and Services: Risk Management Principles," and OCC Bulletin 2023-17, "Third-Party Relationships: Interagency Guidance on Risk Management," as applicable.⁶

Credit Risk Management

Prudent lending policies, as part of sound risk management, support a bank's ability to identify, measure, monitor, and control risk. Banks should establish policies and procedures for BNPL lending that address loan terms, underwriting criteria, methodologies to assess repayment capacity, fees, charge-offs, and credit loss allowance considerations. BNPL underwriting criteria and repayment assessment methodologies should provide reasonable assurance that the borrower can repay the debt. Repayment assessment methodologies may include assessing debt-to-income, debt-to-assets, or residual income; using deposit account information; or using alternative data.⁷ A well-designed repayment capacity assessment promotes successful payment outcomes and reflects reasonable delinquency and loss levels based on loan and customer risk characteristics.

Repayment assessment methodologies that are poorly implemented or not well-designed could result in elevated delinquencies and losses for the bank, as well as late fees, negative credit bureau reporting, or other consequences for the borrower. In addition, with loan payments typically tied to a debit or credit card, overextension can also result in secondary fees charged to the borrower, such as overdraft, non-sufficient funds, and late fees. Designing a BNPL loan with repayment dependent on a borrower incurring additional debt is generally an imprudent practice. Making BNPL loan payments with credit cards or other types of loans could lead to a cycle of debt for the borrower. Consequently, prudent BNPL lending includes safeguards that minimize adverse customer outcomes such as cycles of debt due to rollovers or reborrowing.

Some BNPL lenders use risk-based credit limit assignments to control exposure, with lower lending caps for new or higher-risk borrowers. A "low-and-grow" strategy extends limited credit to first-time borrowers and gradually increases the amount of credit extended as the borrower exhibits positive repayment behavior.

Banks should establish ongoing monitoring and reporting that capture the unique characteristics and risks of BNPL loans. Traditional credit metrics (e.g., loans bucketed by delinquency over 30 days past due) tend to be lagging indicators that might not promptly identify trends and issues in loans of four installments or less. Forecasting, analytics, and stress testing methods should consider BNPL loan structures, risk characteristics, and revenue streams. Methods to collect BNPL debt, mitigate losses, and contact borrowers may warrant specialized approaches and strategies that differ from traditional consumer debt collection practices. For example, the timing of contacting delinquent BNPL borrowers would ordinarily be shorter than with longer-term loans.

Charge-off practices: Operationally, some banks, based on their internal policies, classify unsecured loans as loss once a certain past-due status is reached, such as at 120 or 180 days past due. Nevertheless, a loan should be classified as loss if the full collection of principal and interest is not expected, notwithstanding the number of days past due. A bank's charge-off policies should be appropriately tailored for the short-term nature of BNPL loans. Any information that becomes available indicating that a specific loan will not be repaid (e.g., information related to the likelihood of collection on a specific loan or the inability of the bank to contact the borrower within a reasonable period), should cause the bank to apply its charge-off policies.⁸

Allowances for credit losses (ACL): BNPL loans should be incorporated into a bank's ACL methodology. A bank's method to estimate collectability under Accounting Standards Codification (ASC) Topic 326 should be appropriate for BNPL loans and be consistent with the bank's size and complexity. Bank management should consider the same factors for BNPL loans as it does when estimating expected credit losses for longer-term loans (i.e., the asset's contractual life, the risk of loss, and reasonable and supportable forecasts of future economic conditions), but the methods used may differ from those used for longer-term loans. For example, adjusting historical losses to reflect the bank's expectation of future conditions could involve less measurement uncertainty than with longer-term loans. Although the amount of the allowance could be immaterial relative to the bank's overall financial statements, BNPL loans should be included in the bank's ACL methodology, even if no losses have been incurred as of the measurement date.⁹

Credit Bureau Reporting

Furnishing comprehensive information to the credit bureaus in a timely manner in compliance with the requirements of the Fair Credit Reporting Act and its implementing regulations would help mitigate credit risk associated with BNPL loans.¹⁰ Industry-wide reporting of BNPL loans would aid banks in identifying an applicant's total debt obligations when evaluating repayment ability and avoid overextending borrowers through multiple concurrent BNPL loans. Without comprehensive industry-wide reporting, BNPL lenders may not have full visibility into applicants' activities on other platforms. Furnishing payment information to credit bureaus would also allow borrowers who make on-time payments to demonstrate positive credit behavior and build credit history.

Operational Risk Management

The highly automated nature of BNPL lending, with instantaneous credit decisioning and frequent strong reliance on third parties, may present elevated operational risk, including fraud risk and risks associated with model use.

BNPL loans are often administered in ways that present borrowers with service and support hurdles, including a lack of clear disclosures of loan terms, challenges in filing and resolving borrowers' disputes, and a requirement to use automatic payments for all loan payments. Merchandise returns and merchant disputes can be problematic for BNPL borrowers and lenders because the issue may not be resolved during the brief term of the loan. Consumer complaints to the Consumer Financial Protection Bureau indicate that returns and disputes are a common concern. In some instances, consumers have reported difficulties in informing the BNPL lender that they are disputing a purchase, concerns with continued payment on a disputed item, and a general opacity in the dispute process.¹¹ Banks should have processes for handling merchandise returns and merchant disputes in a way that is fair to consumers and matches disclosures provided to consumers.

Fraud risk management: Before offering BNPL loans, bank management should assess fraud risk and implement controls to mitigate those risks. Assessments should consider common fraud schemes used to circumvent bank systems and controls. Management should also consider operational risks unique to BNPL lending, such as those related to product returns or customer disputes, which may warrant specifically designed internal controls. Additionally, given BNPL borrower demographics and prevalence of online purchases, banks should have processes to confirm that potential borrowers are of legal age to obtain credit.

BNPL loan structures may present elevated first payment default risk from intentional fraud or borrower oversight. Because checking account transactions are not settled in real time, the first payment, usually 25 percent of the loan amount and required at purchase, could fail due to insufficient funds when the transaction settles. Banks should have procedures in place to address first payment default. Procedures should be tailored to the bank's BNPL loan products. If fraud is suspected, the bank should have controls to identify the activity in a timely manner, take steps to mitigate loss, and recognize charge-offs in a timely manner.¹²

Model risk management: A bank's models used in the BNPL lending process (e.g., models used in marketing, credit decisioning, customer service, or fraud risk management) should be subject to sound model risk management and incorporated into a bank's model risk management processes. Additionally, third-party models should be incorporated into the bank's third-party risk management and model risk management processes. Management should conduct appropriate due diligence on the third-party relationship and on the model itself.¹³

Third-Party Risk Management

Whether activities are performed in-house or via a third party, banks are required to operate in a safe and sound manner and in compliance with applicable laws and regulations. The OCC expects a bank to have risk management processes to effectively manage the risks arising from its activities, including from third-party relationships.¹⁴ A bank that partners with a third party, including a merchant, to offer BNPL loans should incorporate that relationship into the bank's third-party risk management processes.

Compliance Risk Management

Bank management should give close attention to the delivery method, timing, and appropriateness of marketing, advertising, and consumer disclosures to ensure that they all clearly state the borrower's obligations under the contract and clearly state any fees that may apply. The lack of clear, standardized disclosure language could obscure the true nature of the product as a loan. Any fees that may apply for late or missed payments, or in other circumstances, should be clearly disclosed. Another important question for bank management to consider is the applicability of consumer protection-related laws and regulations, particularly with respect to product delivery methods, marketing, advertising, and other standardized disclosures. Bank management should also consider billing dispute and error resolution rights and practices relating to automatic payments, multiple payment representments, and late fees. With respect to billing dispute and error resolution, because the BNPL lender can be an intermediary between the merchant and the borrower, there could be a mismatch in timing between customers receiving a credit for their returned merchandise and having BNPL payments drawn from their account. To ensure effective and prompt resolution, BNPL loan terms and associated disclosures should clearly delineate lender obligations and borrower responsibilities.

Bank management should determine the applicability of consumer protection-related laws and regulations to the bank's specific BNPL offerings. Examples of laws and regulations that may apply include the Equal Credit Opportunity Act (ECOA) and Regulation B; Electronic Fund Transfer Act (EFTA) and Regulation E; Fair Credit Reporting Act (FCRA) and Regulation V; section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive acts and practices; and section 1036 of the Dodd–Frank Wall Street Reform and Consumer Protection Act, which prohibits unfair, deceptive, or abusive acts and practices.¹⁵

BNPL lending should be incorporated into the bank's compliance management system (CMS). An appropriate CMS includes board and management oversight (including oversight over applicable third parties) and processes and practices that are designed to manage consumer compliance risk, support compliance with applicable consumer protection-related laws and regulations, and prevent consumer harm.¹⁶

Further Information

Please contact Terence W. Culler, Director for Retail Credit Risk Policy, at (202) 649-6220; Candace B. Matzenauer, Director for Consumer Compliance Policy, at (202) 649-5470; or Tracy Chin, Director for Payments Risk Policy, at (202) 649-6550.

Grovetta N. Gardineer
Senior Deputy Comptroller for Bank Supervision Policy

OCC Resources

• Comptroller's Handbook
  • "Corporate and Risk Governance"
  • "Installment Lending"
  • "Payment Systems"
  • "Retail Lending"
  • "Unfair or Deceptive Acts or Practices and Unfair, Deceptive, or Abusive Acts or Practices"
• OCC Bulletin 2011-12, "Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management"
• OCC Bulletin 2017-43, "New, Modified, or Expanded Bank Products and Services: Risk Management Principles"
• OCC Bulletin 2019-37, "Operational Risk: Fraud Risk Management Principles"
• OCC Bulletin 2019-62, "Consumer Compliance: Interagency Statement on the Use of Alternative Data in Credit Underwriting"
• OCC Bulletin 2020-54, "Small-Dollar Lending: Interagency Lending Principles for Offering Small-Dollar Loans"
• OCC Bulletin 2023-11, "Current Expected Credit Losses: Interagency Policy Statement on Allowances for Credit Losses (Revised April 2023)"
• OCC Bulletin 2023-17, "Third-Party Relationships: Interagency Guidance on Risk Management"