Overview

Over the past two years, prominent lawmakers and bank regulatory agencies have increased public comments and clarified expectations over “buy now, pay later” (BNPL) lending. These pronouncements include two Consumer Financial Protection Bureau (CFPB) reports in September 2022 and March 2023 and the Office of the Comptroller of the Currency (OCC) bulletin providing risk management expectations over BNPL programs. These developments indicate several key themes and takeaways that banks should pay close attention to. Some of these include:

• The CFPB’s September 2022 Report on BNPL lending signals Director Chopra‘s desire to enact a new regulatory regime subjecting BNPL lending to regulatory frameworks similar to those governing traditional credit cards
• The CFPB’s increased scrutiny of BNPL lending seems to fit into its broader agenda of creating regulatory parity between nonbank financial institutions and traditional depository institutions.
• The OCC Bulletin on BNPL lending will likely heighten product risk management and governance expectations, and examiners will leverage the Bulletin during examinations.
• All banks offering, or considering offering, BNPL products should seek support in evaluating themselves against the OCC guidance, either through their own risk governance processes or through engagement with a qualified firm.

Background

The CFPB defines BNPL lending as a form of credit that allows a consumer to fully purchase a product and then pay back the loan over a few installments, typically four installments, with the first installment typically serving as a down payment. Comparatively, the OCC bulletin defines BNPL as loans that are often approved at the time of purchase, with some lenders approving BNPL loans before or after purchase. Additionally, some lenders require 25 percent of the total transaction paid at the time of purchase, which in most cases serves as the first payment.

The main difference between BNPL lending and traditional credit cards is that BNPL payments usually do not include interest or finance charges. Instead, merchants charge lenders a discounted amount of the full purchase price of the good or service, with the lender collecting the revenue as the borrower makes installment payments. The difference between the discounted amount of the purchase price and total installment payments is the lender’s primary source of revenue from BNPL transactions. The BNPL payment schedule is predetermined and consists of two to four standardized payments spanning a few weeks to a couple of months.

The most common type of BNPL lending is the “pay-in-four” model, which allows lenders to split payments into four interest-free installments. BNPL lending cannot exceed four payments without being subjected to the Truth in Lending Act (TILA). The TILA, as implemented by Regulation Z, generally requires lenders to disclose to prospective borrowers the costs and terms of a particular loan or credit product. However, because Regulation Z only applies to businesses or individuals that extend credit “subject to a finance charge” or payable by a “written agreement in more than four installments,” BNPL lending does not fall under the scope of Regulation Z.

Regulatory Timeline of BNPL Lending

The CFPB’s Two Reports on BNPL Lending

The CFPB’s September 2022 report derived from a December 2021 market order to five BNPL lenders which sought to collect information on the risks and benefits of BNPL credit.

CFPB Director Chopra prefaced the 2022 report by affirming that the CFPB would work to ensure that borrowers have “similar protections”, irrespective of whether they use a credit card or a BNPL loan. Director Chopra also alleged that BNPL lending “serves as a close substitute for credit cards.”  The report seemingly signaled Director Chopra ‘s desire to enact a new regulatory regime subjecting BNPL lending to regulatory frameworks similar to those governing traditional credit cards. However, despite Director Chopra’s comparisons, BNPL lending differs from traditional credit cards in that it levies no finance charges and offers both fixed monthly installments and instant approval. Moreover, BNPL lending typically does not require a “hard” credit check. Most of the largest BNPL lenders including Affirm, Afterpay, Klarna, PayPal, and Zip either skip credit inquiries entirely, or conduct “soft” credit inquires which do not impact consumers’ credit scores.

While the CFPB’s March 2023 report found that BNPL borrowers often show higher levels of financial stress, the report also notes that many credit history differences existed before BNPL use. Consequently, the report called for further research to assess whether BNPL products causally affect consumer indebtedness.

The OCC’s Regulatory Guidance Related to BNPL Lending

The OCC’s guidance to national banks and federal savings associations offering BNPL loans covers four key risk areas:

1. Credit Risk Management
2. Credit Bureau Reporting
3. Operational Risk Management
4. Compliance Risk Management

Credit Risk Management

The guidance emphasizes the importance of prudent lending policies for effective credit risk management. It suggests implementing lending policies covering loan terms, underwriting criteria, repayment assessment methodologies, fees, charge-offs, and credit loss allowance considerations. Moreover, the guidance maintains that repayment assessment methods, including debt-to-income ratios or alternative data, should help to provide reasonable assurance of borrower repayment capacity.

The guidance also cautions against poorly implemented policies and procedures to address loan terms and underwriting criteria, which can lead to elevated delinquencies, late fees, and negative credit bureau reporting. It stresses the importance of safeguards against debt cycles and overextension, and recommends risk-based credit limit assignments, a “low-and-grow” strategy, and tailored ongoing monitoring. Charge-off practices and allowances for credit losses are advised to be adapted for the short-term nature of BNPL loans.

Finally, the guidance underscores the necessity of incorporating BNPL loans into a bank’s Allowance for Credit Losses (ACL) methodology, consistent with the bank’s size and complexity, and in line with Accounting Standards Codification Topic 326.

Credit Bureau Reporting

The guidance recommends that banks promptly furnish comprehensive information to credit bureaus, in line with the Fair Credit Reporting Act. Without such reporting, the guidance cautions that BNPL lenders may lack visibility into applicants’ activities on other platforms.

Operational Risk Management

The guidance asserts that the highly automated nature of Buy Now, Pay Later (BNPL) lending, coupled with instantaneous credit decisions and reliance on third parties, may pose elevated operational risks, including fraud and model use risks. It emphasizes concerns such as unclear disclosures of loan terms, challenges in resolving borrower disputes, and the mandatory use of automatic payments.

Consequently, the guidance emphasizes the importance of fraud risk management, particularly addressing elevated first payment default risk. It also stresses the importance of model risk management, necessitating robust processes for both in-house and third-party models used in marketing, credit decisions, and customer service.

Compliance Risk Management

The guidance directs banks to ensure that all marketing, advertising, and consumer disclosure materials clearly communicate borrowers’ obligations and applicable fees. It encourages banks to assess the applicability of consumer protection-related laws and regulations, including the Equal Credit Opportunity Act (ECOA), the Electronic Fund Transfer Act (EFTA), the Fair Credit Reporting Act (FCRA), section 5 of the Federal Trade Commission Act, and section 1036 of the Dodd–Frank Act.

Patomak Insights

CFPB Takeaways

Despite the CFPB’s March 2023 report on the lending profiles of BNPL borrowers calling for further research to establish causation, CFPB Director Chopra asserted that it was “a common misconception” that BNPL borrowers “lack access to other forms of credit.”

Director Chopra’s rhetoric was seemingly aimed at advocates of BNPL loans who often argue that because regulatory pile-ons have made traditional credit more expensive, BNPL lending can offer many consumers a beneficial alternative. For example, the Chairman of the House Financial Services Subcommittee on Digital Assets, Financial Technology, and Inclusion posited that BNPL products: “give consumers a technological way to have choice at checkout and more flexibility to pay on their schedule in a way they can easily understand.”

The CFPB’s increased scrutiny of BNPL lending seems to fit into its broader agenda of creating regulatory parity between nonbank financial institutions and traditional depository institutions. The CFPB is required by statute to ensure that “outdated, unnecessary, or unduly burdensome regulations are regularly identified and addressed in order to reduce unwarranted regulatory burdens.” The CFPB is also required to ensure that Federal consumer financial law is enforced consistently, “without regard to the status of a person as a depository institution.” Read together, these objectives obligate the CFPB to try to reduce unwarranted regulatory burdens to level the playing field between depository institutions and nonbanks. However, the CFPB only proposes to accomplish this by increasing regulatory burdens on certain nonbanks rather than considering burden-reducing alternatives.

OCC Takeaways

While the OCC guidance clarifies the agency’s position on its product-specific regulatory expectations for federally chartered institutions, it also establishes baseline risk management expectations that may pose implementation challenges or be costly for banks offering BNPL products. For example, credit risk management expectations around ability to repay analysis, charge-off practices, and allowance for credit losses accounting are all elevated. The OCC Bulletin will likely heighten product risk management and governance expectations and examiners will leverage the Bulletin during examinations. While the longer-term impacts of the OCC Bulletin are uncertain at this point, these heightened expectations may influence BNPL pricing or induce banks to limit product offerings.

All banks offering or considering to offer BNPL products should seek support in evaluating themselves against the OCC guidance, either through their own risk governance processes or through engagement with a qualified firm. Aside from the credit risk management considerations mentioned above, operational risk management considerations must consider fraud and model risk management, and third-party risk management practices, inclusive of all third parties involved in BNPL products including merchants.

Further, risk management practices and audit reviews should incorporate consumer compliance laws and regulations, including:

• Equal Credit Opportunity Act (ECOA) and Regulation B;
• Electronic Fund Transfer Act (EFTA) and Regulation E;
• Fair Credit Reporting Act (FCRA) and Regulation V; and
• Section 5 of the Federal Trade Commission Act and section 1036 of the Dodd–Frank Wall Street Reform and Consumer Protection Act unfair, deceptive, or abusive acts and practices.

Put Patomak’s Expertise to Work

Patomak has deep experience in helping banks and other financial institutions identify and manage risks and respond to developments in banking regulation and supervision. Patomak can work with boards and management to assess their governance and internal risk and control functions proactively to ensure they meet supervisory expectations and support their business objectives. If you would like to learn more about how Patomak can partner with you, please contact Brian Johnson, Managing Director, at bjohnson@patomak.com or John Vivian, Managing Director, at jvivian@patomak.com.