CCD2 and the End of the BNPL Grey Zone: What the New Consumer Credit Rules Mean for Fintechs

Update, 11 October 2026: Germany has completed transposition: the implementing act of 12 May 2026 (Federal Law Gazette 2026 I No. 139) enters into force on 20 November 2026. Buy-now-pay-later models are covered; debit cards with deferred debit stay outside only if the amount is repaid within 40 days, interest-free and at low cost. The act also adds a supervisory layer: lenders that are not supervised institutions must register with BaFin under the new Absatzfinanzierungsaufsichtsgesetz — with a twelve-month transition for existing providers and an exemption for small and medium-sized merchants that only grant interest-free deferrals on their own goods — and credit intermediaries need a permit under the new Section 34k GewO.

Buy-now-pay-later built a billion-euro industry inside a regulatory exemption: short-term, interest-free credit simply was not “credit” in the eyes of the old Consumer Credit Directive. That construction ends this year. The second Consumer Credit Directive — CCD2 — closes the gap deliberately, and the firms it touches have known the date for three years.

The legal mechanics first. Directive (EU) 2023/2225 entered into force in November 2023, replaced the 2008 directive, and gave member states until 20 November 2025 to transpose it — with the new rules applying from 20 November 2026. For B2C credit business in the DACH region, this is therefore the year in which product, process, and marketing must arrive in the new world.

The headline change is scope. The old exemptions that carried BNPL — credit under 200 euros, interest-free deferred payment, short-term credit repaid within three months at negligible cost — are largely dismantled or narrowed. Deferred payment products offered by third parties, the core of the modern BNPL model, come under the directive's regime: pre-contractual information, creditworthiness assessment, right of withdrawal, and conduct rules included. A carve-out survives for genuinely free deferrals by the merchant itself under tight conditions — but the platform-driven BNPL economy is inside the perimeter.

Creditworthiness: From Checkbox to Obligation

CCD2 hardens the creditworthiness assessment into a genuine consumer-protection duty: conducted before conclusion, based on relevant and proportionate information on income and expenses, and — crucially — credit may only be granted where the assessment indicates the consumer is likely able to repay. For BNPL providers whose conversion funnel was engineered around frictionless checkout, this is the strategic wound: the assessment must be real, documented, and proportionate to the product, and “the algorithm approved it” is not a defence if the data behind the algorithm was inadequate.

The directive also modernises the conduct environment around the assessment: advertising rules against normalising debt, a ban on pre-ticked boxes and unsolicited credit granting, rules on advisory services, and forbearance expectations before enforcement. Where automated decision-making is used, consumers gain a right to human intervention and an explanation — a provision that quietly connects CCD2 to the AI Act's logic, since credit scoring is simultaneously a high-risk AI use case.

The DACH Reading

Germany is one of Europe's largest BNPL markets and its most invoice-loyal: purchase on account (Rechnungskauf) is a cultural institution that BNPL platforms industrialised. The German implementing act draws the line as the directive does: where the merchant itself grants a free payment term of no more than 50 days and no third party finances it, the arrangement stays outside consumer credit law — for large online sellers only up to 14 days and only if the claim is not passed on to a third party — while third-party financed models carry the full programme. Austria has transposed as well, with its Consumer Credit Act 2026; Switzerland, outside the EU framework, keeps its own Consumer Credit Act, which is strict on interest caps and creditworthiness checks but does not cover credit below CHF 500 or credit repayable within three months — so most short-term BNPL stays outside it.

“

BNPL's regulatory holiday was a launch subsidy, not a business model. The firms that survive CCD2 are the ones that treated it as such.

Who Feels It Beyond BNPL

• Merchants and marketplaces embedding financing: the boundary between exempt merchant deferral and regulated credit intermediation needs a fresh legal read per model.
• Banks behind the platforms: as the lenders of record, they inherit the compliance burden their fintech partners implement — partner-bank contracts are being renegotiated accordingly.
• Credit brokers and comparison platforms: tightened rules on intermediaries, advice, and remuneration transparency reshape affiliate economics.
• Debt-collection adjacent models: forbearance duties before enforcement change the recovery playbook for consumer credit.

A Preparation Sequence for the Remaining Months

1. 01Re-classify every product variant against the transposed national law — the exemption you relied on may no longer exist in the shape you remember.
2. 02Have it checked whether you must register with BaFin as a lender or need a permit as a credit intermediary under Section 34k GewO — and note the transition periods.
3. 03Rebuild the creditworthiness assessment as a documented, proportionate process with audit trails — including the data sources and their justification.
4. 04Redesign checkout flows: information duties and withdrawal rights must fit inside a conversion funnel without dark patterns.
5. 05Review advertising and app-store copy against the new marketing rules — regulators read them too.
6. 06If automated decisions are involved, align the CCD2 explanation duties with your AI Act preparations rather than building twice.

The Data Question Inside the Assessment

Beneath the creditworthiness duty sits a quieter fight about data. CCD2 expects assessments built on information that is genuinely relevant and proportionate — which invites scrutiny of the categorical opposite: scores inferred from shopping baskets, device signals, or social heuristics. Providers should expect national supervisors and data-protection authorities to read the assessment file together, because the same decision sits under CCD2, the GDPR's automated-decision rules, and — where models qualify — the AI Act's high-risk regime. Firms that design one coherent decision architecture with documented features, tested fairness, and explainable outputs answer three regulators with one artefact; firms that maintain three parallel stories eventually contradict themselves in writing.

There is also a commercial asymmetry worth naming: incumbent banks have run regulated consumer-credit decisioning for decades and will absorb CCD2 as an update. For BNPL-native firms it is a first migration into supervised credit practice — and the partners, investors, and platform clients watching that migration will treat its quality as a proxy for the firm's overall maturity.

Conclusion

CCD2 does not kill BNPL; it graduates it. Deferred payment becomes what it economically always was — consumer credit — with the duties that follow. For well-capitalised providers, regulation is a moat against the undisciplined end of the market; for merchants and banks in the DACH region, it is a contract-renegotiation season with a hard deadline. Aegiron Capital Group supports fintechs and their partners in preparing operations for the new regime; the legal classification of products and legal advice come from the law firm you engage.