An official website of the United States government
OCC Bulletin 2023-37 | December 6, 2023
Share This Page:
Chief Executive Officers of All National Banks, Federal Savings Associations, and Federal Branches and Agencies; Department and Division Heads; All Examining Personnel; and Other Interested Parties
The Office of the Comptroller of the Currency (OCC) is issuing this bulletin to assist banks1 in effectively managing risks associated with "buy now, pay later" (BNPL) lending and in offering BNPL loans in a responsible manner. The OCC expects banks that offer BNPL loans to do so in a manner that is safe and sound, provides fair access to financial services, supports fair treatment of consumers, and complies with applicable laws and regulations. This bulletin is consistent with OCC support of bank efforts to meet evolving needs of consumers, businesses, and communities in a safe, sound, and fair manner.
"Buy now, pay later" is widely used to describe various types of installment lending products.2 This bulletin addresses BNPL loans that are payable in four or fewer installments and carry no finance charges (i.e., the loans carry 0 percent interest and no other finance charges). Other characteristics of BNPL loans can vary. Loans with payment terms greater than four installments or that charge interest or carry other finance charges are treated as traditional installment loans (a longstanding bank product) and are therefore not within the scope of this bulletin.
This bulletin applies to community banks offering or considering offering BNPL loans.
This bulletin
BNPL loans are also referred to as "point-of-sale installment loans" or "pay-in-4" loans. BNPL loan offerings have rapidly increased in recent years, and consumers are using BNPL loans for a diverse range of products and services. BNPL loans are a popular payment option, especially for online purchases. While BNPL loans' popularity continues to grow across all demographics, industry data suggest that the loans have gained rapid acceptance by tech-savvy younger generations and consumers with limited or no credit bureau history. If deployed and used responsibly, BNPL loans can provide consumers with a low-cost, short-term, small-dollar financing alternative to manage cash flow.
BNPL loans are often approved at the time of purchase, but some lenders approve BNPL loans before or after purchase. Additionally, some lenders require 25 percent of the total transaction paid at the time of purchase. In most cases, the 25 percent paid at purchase serves as the first payment.
Banks can contract directly with merchants to offer BNPL loans or go through a third-party BNPL provider that serves as an intermediary between merchants and lenders. Banks can also offer BNPL loans in-house without contracting with merchants or third parties. BNPL providers may facilitate low barriers to entry for banks because they have existing lending platforms, acquisition models, and servicing capabilities. As with all third-party relationships, a bank's relationship with a merchant or a third-party BNPL provider should be subject to effective third-party risk management.3
In a typical BNPL transaction, the lender pays the merchant for the good or service and takes on the responsibility of granting credit and collecting payments from the borrower.4 In their role as payment processor and lender, BNPL lenders assume borrower default risk. To compensate for the risk, merchants charge lenders a discounted amount of the full purchase price of the good or service. The lender then collects the full purchase price through installment payments from the borrower. The difference between the discounted amount of the purchase price and total installment payments is the lender's primary source of revenue from BNPL transactions. Payments are generally made automatically from the borrower's debit card, credit card, or checking account. If the borrower does not pay on time, the lender may, for example, charge late fees and refuse to make additional BNPL loans to the borrower until the borrower brings the account current.
The rapidly growing availability of BNPL loans could pose risks related to consumer credit reporting. BNPL loans may not be fully captured in borrower credit histories. Many BNPL lenders use soft credit bureau inquiries5 to approve borrowers. Existing credit scoring systems are not designed to capture the very short-term nature and structure of BNPL loans. Incomplete reporting of BNPL loans could make it difficult for lenders to know the total dollar amount of debts and other obligations that applicants have before determining whether to approve them for new credit. The three major credit bureaus announced they would begin including BNPL transactions in their reporting, but it could take some time before BNPL activity is consistently reflected in credit scores.
When used responsibly and offered in a transparent manner, BNPL loans can support consumers' overall financial capabilities by providing a convenient and relatively low-cost option compared with alternative financing. Nevertheless, BNPL lending carries risks for banks and consumers. BNPL lending can result in credit, compliance, operational, strategic, and reputation risks to banks. Risks to banks and consumers include the following:
Banks engaging in BNPL lending should do so within a risk management system that is commensurate with associated risks. Risk management systems should be designed to capture the unique characteristics and risks of BNPL loans. Banks should maintain underwriting, repayment terms, pricing, and safeguards that minimize adverse customer outcomes and should ensure that marketing materials and disclosures are clear and conspicuous. Comprehensive and consistent credit bureau reporting that complies with the requirements of the Fair Credit Reporting Act and its implementing regulations helps banks manage credit risk and would allow borrowers who make on-time payments to demonstrate positive credit behavior and build credit history. Bank management should also consider the bank's strategic plan and risk appetite when making the decision to engage in BNPL lending.
In conjunction with this bulletin, bank management should also refer to OCC Bulletin 2020-54, "Small-Dollar Lending: Interagency Lending Principles for Offering Responsible Small-Dollar Loans," OCC Bulletin 2017-43, "New, Modified, or Expanded Bank Products and Services: Risk Management Principles," and OCC Bulletin 2023-17, "Third-Party Relationships: Interagency Guidance on Risk Management," as applicable.6
Prudent lending policies, as part of sound risk management, support a bank's ability to identify, measure, monitor, and control risk. Banks should establish policies and procedures for BNPL lending that address loan terms, underwriting criteria, methodologies to assess repayment capacity, fees, charge-offs, and credit loss allowance considerations. BNPL underwriting criteria and repayment assessment methodologies should provide reasonable assurance that the borrower can repay the debt. Repayment assessment methodologies may include assessing debt-to-income, debt-to-assets, or residual income; using deposit account information; or using alternative data.7 A well-designed repayment capacity assessment promotes successful payment outcomes and reflects reasonable delinquency and loss levels based on loan and customer risk characteristics.
Repayment assessment methodologies that are poorly implemented or not well-designed could result in elevated delinquencies and losses for the bank, as well as late fees, negative credit bureau reporting, or other consequences for the borrower. In addition, with loan payments typically tied to a debit or credit card, overextension can also result in secondary fees charged to the borrower, such as overdraft, non-sufficient funds, and late fees. Designing a BNPL loan with repayment dependent on a borrower incurring additional debt is generally an imprudent practice. Making BNPL loan payments with credit cards or other types of loans could lead to a cycle of debt for the borrower. Consequently, prudent BNPL lending includes safeguards that minimize adverse customer outcomes such as cycles of debt due to rollovers or reborrowing.
Some BNPL lenders use risk-based credit limit assignments to control exposure, with lower lending caps for new or higher-risk borrowers. A "low-and-grow" strategy extends limited credit to first-time borrowers and gradually increases the amount of credit extended as the borrower exhibits positive repayment behavior.
Banks should establish ongoing monitoring and reporting that capture the unique characteristics and risks of BNPL loans. Traditional credit metrics (e.g., loans bucketed by delinquency over 30 days past due) tend to be lagging indicators that might not promptly identify trends and issues in loans of four installments or less. Forecasting, analytics, and stress testing methods should consider BNPL loan structures, risk characteristics, and revenue streams. Methods to collect BNPL debt, mitigate losses, and contact borrowers may warrant specialized approaches and strategies that differ from traditional consumer debt collection practices. For example, the timing of contacting delinquent BNPL borrowers would ordinarily be shorter than with longer-term loans.
Charge-off practices: Operationally, some banks, based on their internal policies, classify unsecured loans as loss once a certain past-due status is reached, such as at 120 or 180 days past due. Nevertheless, a loan should be classified as loss if the full collection of principal and interest is not expected, notwithstanding the number of days past due. A bank's charge-off policies should be appropriately tailored for the short-term nature of BNPL loans. Any information that becomes available indicating that a specific loan will not be repaid (e.g., information related to the likelihood of collection on a specific loan or the inability of the bank to contact the borrower within a reasonable period), should cause the bank to apply its charge-off policies.8
Allowances for credit losses (ACL): BNPL loans should be incorporated into a bank's ACL methodology. A bank's method to estimate collectability under Accounting Standards Codification (ASC) Topic 326 should be appropriate for BNPL loans and be consistent with the bank's size and complexity. Bank management should consider the same factors for BNPL loans as it does when estimating expected credit losses for longer-term loans (i.e., the asset's contractual life, the risk of loss, and reasonable and supportable forecasts of future economic conditions), but the methods used may differ from those used for longer-term loans. For example, adjusting historical losses to reflect the bank's expectation of future conditions could involve less measurement uncertainty than with longer-term loans. Although the amount of the allowance could be immaterial relative to the bank's overall financial statements, BNPL loans should be included in the bank's ACL methodology, even if no losses have been incurred as of the measurement date.9
Furnishing comprehensive information to the credit bureaus in a timely manner in compliance with the requirements of the Fair Credit Reporting Act and its implementing regulations would help mitigate credit risk associated with BNPL loans.10 Industry-wide reporting of BNPL loans would aid banks in identifying an applicant's total debt obligations when evaluating repayment ability and avoid overextending borrowers through multiple concurrent BNPL loans. Without comprehensive industry-wide reporting, BNPL lenders may not have full visibility into applicants' activities on other platforms. Furnishing payment information to credit bureaus would also allow borrowers who make on-time payments to demonstrate positive credit behavior and build credit history.
The highly automated nature of BNPL lending, with instantaneous credit decisioning and frequent strong reliance on third parties, may present elevated operational risk, including fraud risk and risks associated with model use.
BNPL loans are often administered in ways that present borrowers with service and support hurdles, including a lack of clear disclosures of loan terms, challenges in filing and resolving borrowers' disputes, and a requirement to use automatic payments for all loan payments. Merchandise returns and merchant disputes can be problematic for BNPL borrowers and lenders because the issue may not be resolved during the brief term of the loan. Consumer complaints to the Consumer Financial Protection Bureau indicate that returns and disputes are a common concern. In some instances, consumers have reported difficulties in informing the BNPL lender that they are disputing a purchase, concerns with continued payment on a disputed item, and a general opacity in the dispute process.11 Banks should have processes for handling merchandise returns and merchant disputes in a way that is fair to consumers and matches disclosures provided to consumers.
Fraud risk management: Before offering BNPL loans, bank management should assess fraud risk and implement controls to mitigate those risks. Assessments should consider common fraud schemes used to circumvent bank systems and controls. Management should also consider operational risks unique to BNPL lending, such as those related to product returns or customer disputes, which may warrant specifically designed internal controls. Additionally, given BNPL borrower demographics and prevalence of online purchases, banks should have processes to confirm that potential borrowers are of legal age to obtain credit.
BNPL loan structures may present elevated first payment default risk from intentional fraud or borrower oversight. Because checking account transactions are not settled in real time, the first payment, usually 25 percent of the loan amount and required at purchase, could fail due to insufficient funds when the transaction settles. Banks should have procedures in place to address first payment default. Procedures should be tailored to the bank's BNPL loan products. If fraud is suspected, the bank should have controls to identify the activity in a timely manner, take steps to mitigate loss, and recognize charge-offs in a timely manner.12
Model risk management: A bank's models used in the BNPL lending process (e.g., models used in marketing, credit decisioning, customer service, or fraud risk management) should be subject to sound model risk management and incorporated into a bank's model risk management processes. Additionally, third-party models should be incorporated into the bank's third-party risk management and model risk management processes. Management should conduct appropriate due diligence on the third-party relationship and on the model itself.13
Whether activities are performed in-house or via a third party, banks are required to operate in a safe and sound manner and in compliance with applicable laws and regulations. The OCC expects a bank to have risk management processes to effectively manage the risks arising from its activities, including from third-party relationships.14 A bank that partners with a third party, including a merchant, to offer BNPL loans should incorporate that relationship into the bank's third-party risk management processes.
Bank management should give close attention to the delivery method, timing, and appropriateness of marketing, advertising, and consumer disclosures to ensure that they all clearly state the borrower's obligations under the contract and clearly state any fees that may apply. The lack of clear, standardized disclosure language could obscure the true nature of the product as a loan. Any fees that may apply for late or missed payments, or in other circumstances, should be clearly disclosed. Another important question for bank management to consider is the applicability of consumer protection-related laws and regulations, particularly with respect to product delivery methods, marketing, advertising, and other standardized disclosures. Bank management should also consider billing dispute and error resolution rights and practices relating to automatic payments, multiple payment representments, and late fees. With respect to billing dispute and error resolution, because the BNPL lender can be an intermediary between the merchant and the borrower, there could be a mismatch in timing between customers receiving a credit for their returned merchandise and having BNPL payments drawn from their account. To ensure effective and prompt resolution, BNPL loan terms and associated disclosures should clearly delineate lender obligations and borrower responsibilities.
Bank management should determine the applicability of consumer protection-related laws and regulations to the bank's specific BNPL offerings. Examples of laws and regulations that may apply include the Equal Credit Opportunity Act (ECOA) and Regulation B; Electronic Fund Transfer Act (EFTA) and Regulation E; Fair Credit Reporting Act (FCRA) and Regulation V; section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive acts and practices; and section 1036 of the Dodd–Frank Wall Street Reform and Consumer Protection Act, which prohibits unfair, deceptive, or abusive acts and practices.15
BNPL lending should be incorporated into the bank's compliance management system (CMS). An appropriate CMS includes board and management oversight (including oversight over applicable third parties) and processes and practices that are designed to manage consumer compliance risk, support compliance with applicable consumer protection-related laws and regulations, and prevent consumer harm.16
Please contact Terence W. Culler, Director for Retail Credit Risk Policy, at (202) 649-6220; Candace B. Matzenauer, Director for Consumer Compliance Policy, at (202) 649-5470; or Tracy Chin, Director for Payments Risk Policy, at (202) 649-6550.
Grovetta N. Gardineer Senior Deputy Comptroller for Bank Supervision Policy
1 "Banks" refers collectively to national banks, federal savings associations, and federal branches and agencies of foreign banking organizations.
2 Refer to the "Background" section of this bulletin for a more detailed description of common BNPL loan characteristics.
3 For more information, refer to the "Third-Party Risk Management" section of this bulletin and OCC Bulletin 2023-17, "Third Party Risk Management: Interagency Guidance on Risk Management."
4 Payment to the merchant for the good or service is typically settled in a daily batch shortly after the time of purchase.
5 A soft inquiry is a type of credit bureau inquiry that does not affect an applicant's credit score, although it may appear on the applicant's credit report.
6 While designed for use by examiners, the "Installment Lending" and "Retail Lending" booklets of the Comptroller's Handbook may also provide useful information for banks.
7 For guidance on using alternative data, refer to OCC Bulletin 2019-62, "Consumer Compliance: Interagency Statement on the Use of Alternative Data in Credit Underwriting."
8 Write-offs must be recorded in the period in which the financial assets are deemed uncollectible. Refer to ASC paragraph 326-20-35-8, "Write-Offs of Financial Instruments."
9 For more information, refer to OCC Bulletin 2023-11, "Current Expected Credit Losses: Interagency Policy Statement on Allowances for Credit Losses (Revised April 2023)."
10 The three major credit bureaus announced they would begin including BNPL transactions in their reporting. Banks should report BNPL loan information to credit bureaus when the credit bureaus have begun accepting this information for reporting.
11 For more information, refer to "Buy Now, Pay Later: Market trends and consumer impacts," Consumer Financial Protection Bureau (September 2022).
12 For fraud risk management guidance, refer to OCC Bulletin 2019-37, "Operational Risk: Fraud Risk Management Principles." Refer also to the "Charge-off Practices" section of this bulletin.
13 For model risk management guidance, refer to OCC Bulletin 2011-12, "Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management."
14 For third-party risk management guidance, refer to OCC Bulletin 2023-17, "Third-Party Relationships: Interagency Guidance on Risk Management."
15 Statutes and implementing regulations are 15 USC 1691 et seq. (ECOA); 12 CFR 1002 (Regulation B); 15 USC 1693 et seq. (EFTA); 12 CFR 1005 (Regulation E); 15 USC 1691 et seq. (FCRA); 12 CFR 1022 (Regulation V); 15 USC 45(a)(1) (section 5 of the Federal Trade Commission Act); 15 USC 5536 (section 1036 of the Dodd–Frank Act).
16 For more information about CMS, refer to the "Compliance Management Systems" booklet of the Comptroller's Handbook.
