A pair of socks, a phone or even a new bicycle: buying online is part of everyday life for many people. With “buy now, pay later” (BNPL), the barrier is even lower. Payment follows only after delivery and is usually arranged without immediate interest or an extensive application process. As a result, this form of payment is often not experienced as credit. At the same time, its use can have consequences, for example when multiple payment obligations accumulate or when a registration with the Credit Registration Bureau (BKR) applies.
Alongside convenience, these payment methods also bring points of attention. Deferring payments may lead consumers to take on several obligations at the same time, making it harder to maintain oversight. Supervisory authorities note that this can, in certain cases, contribute to financial vulnerability. In its publication Trendview 2026, the Netherlands Authority for the Financial Markets (AFM) identifies the risk of over-indebtedness—including buy now, pay later constructions—as an important concern. This development is also being monitored at European level. The revision of the Consumer Credit Directive, referred to as Consumer Credit Directive 2 (CCD2), aims, among other things, to strengthen consumer protection in a growing market for online credit products.
What is CCD2?
CCD2 is the new European Consumer Credit Directive. It sets out rules intended to better protect consumers when they borrow money or purchase goods on instalment. It replaces the existing European directive from 2008 (CCD1) and will be transposed into Dutch law. The main amendments will be made to Book 7 of the Dutch Civil Code, the Financial Supervision Act (Wft), and the Consumer Credit Act (Wck), which will be integrated into the Civil Code.
The objective of the new directive remains the same: a single regulatory framework for consumer credit, ensuring a high level of consumer protection and a well-functioning internal market.
When CCD1 was adopted in 2008, online lending was still in its infancy. Buy now, pay later barely existed, and purchases via apps or webshops were far less common than they are today. Since then, digitalisation has fundamentally changed the way consumers borrow. The European Parliament has observed that, partly due to economic uncertainty and inflation, consumers increasingly rely on small loans or BNPL services. At the same time, the existing regulatory framework falls short in terms of protection, for example with regard to information provision, creditworthiness assessments and transparency. An update of the rules was therefore inevitable.
CCD2: new rules of the game for consumer credit
With the introduction of CCD2, several aspects of consumer credit will change. The directive responds to the way consumers borrow and pay today: quickly, digitally and often in small amounts. Whereas previous rules mainly focused on traditional loans, CCD2 explicitly addresses modern payment methods such as instalment payments and buy now, pay later.
Small amounts also under supervision
One of the most important changes is the expansion of the scope. Whereas the old directive applied only to credits of €200 or more (and in the Netherlands credit registration applied from €250), smaller amounts now also fall under the rules, up to a maximum of €100,000. This means that not only personal loans are affected, but also everyday purchases paid for in instalments. For example, an online order of €75 paid in three instalments. Such arrangements often previously fell outside the regulatory framework, but will now be subject to the same basic rules on transparency and consumer protection.
Knowing where you stand before you commit
CCD2 also tightens the rules on pre-contractual information. Consumers must be clearly informed in advance about the key features and costs of the credit, enabling them to make an informed decision. If this information is not provided at least one day before the agreement is concluded, the lender or intermediary must inform the consumer in writing of their right of withdrawal within seven days after conclusion. The underlying principle is simple: only when you know what you are entering into can you make a responsible decision.
Buy now, pay later becomes genuine credit
A notable change is that buy now, pay later is no longer regarded as a casual payment option, but explicitly as credit. Providers and intermediaries will therefore, in principle, be subject to licensing or registration requirements. This also applies to webshops that allow customers to pay in instalments or only after thirty days. There are limited exemptions, for example for SMEs that act merely as ancillary intermediaries or offer interest-free payment deferral without costs other than late-payment charges. The general rule, however, is clear: anyone facilitating consumer credit falls under supervision.
Additional protection for minors
The Netherlands is going one step further by explicitly prohibiting BNPL for minors. Minors will no longer be allowed to purchase goods on instalment through such constructions. This policy choice was prompted by the AFM’s observation that age checks were insufficient in practice and that minors were nonetheless making extensive use of BNPL services. The aim of the ban is to better protect young consumers from early indebtedness.
Can the consumer afford it?
The creditworthiness assessment is also given a stronger footing. As under the old directive, it remains an open standard, but CCD2 provides more guidance on how it should be applied. In the Netherlands, lenders are currently required to report loans of €250 or more with a term longer than one month to the Credit Registration Bureau (BKR), including mobile phone subscriptions with handset financing. This threshold will be removed.
The Dutch legislative proposal on BKR credit registration introduces new rules for the registration and assessment of consumer credit. Under these proposals, lenders will be required to be affiliated with the Credit Registration Bureau (BKR). This means they must both register credits with the BKR and consult the credit information database before granting credit. These changes are intended to formalise creditworthiness assessments and ensure that credit data are systematically taken into account in credit decisions. The proposal also includes provisions on, among other things, obligations to identify consumers in financial difficulty at an early stage and refer them to debt counselling, a ban on lending to minors, and stricter pre-contractual information requirements.
The extent of the credit assessment will depend on the nature, duration, size and risks of the credit. For a small instalment purchase, a lighter assessment may suffice than for a large loan with a long term, but in all cases it must be assessed whether the consumer can reasonably afford the credit. This helps to prevent debts from accumulating unnoticed.
In its AFM report on buy now, pay later, the AFM explicitly states that the current threshold for a creditworthiness assessment and BKR check (currently €250) offers insufficient protection under the revised CCD2 framework. The supervisor therefore supports lowering this threshold, as nine out of ten BNPL transactions that resulted in payment problems fell below the €250 threshold and therefore did not require an assessment or registration under the current rules. Without lowering the threshold, precisely these transactions would remain outside formal credit checks and BKR registration, perpetuating potential risks for consumers.
Fair advertising, no unrealistic promises
Finally, the rules on credit advertising will be tightened. Advertising must be fair, clear and not misleading. Messages that create unrealistic expectations about the availability or cost of credit will be prohibited. Any suggestion that borrowing is carefree will no longer be permitted if, in reality, interest, costs or significant consequences in the event of late payment apply.
What does CCD2 mean for organisations?
The introduction of CCD2 will bring substantial changes for organisations involved in consumer credit. As the new rules will apply from 20 November 2026, timely preparation is essential. Although the exact details may still evolve during 2026, the main principles are clear. Organisations should therefore already be assessing which processes and systems will need to be adapted. Below is an overview of some of the implications of CCD2 for organisations.
Expansion of AFM supervision to (online) webshops, private leasing and credit card providers
CCD2 brings more parties within the AFM’s supervisory remit. While traditional lenders are generally already familiar with the Wft regime, this is not necessarily the case for webshops and platforms that offer or intermediate BNPL services. For large companies whose main activity is selling products and that offer BNPL through a third party, a registration requirement with the AFM will apply. As a result, (tied) intermediaries will fall under the Wft regime and must comply with all associated obligations.
In addition, the Wft will also apply to rental and lease agreements that include a purchase option or where it is intended that the product becomes the consumer’s property at the end of the term. Private lease agreements with such fixed purchase arrangements will therefore more often be regarded as consumer credit. For providers and parties facilitating these contracts, such as dealers and platforms, this may mean falling under AFM supervision and having to comply with additional rules.
Credit cards with deferred payment will also fall more clearly within the scope, as the relevant exemption will be removed. Consequently, Wft requirements and AFM supervision will apply, leading in practice to changes in terms and conditions and customer communications, and to more careful organisation of processes around creditworthiness, distribution and compliance.
More extensive creditworthiness assessment
A second change with major operational impact is the creditworthiness assessment. As under CCD1, this remains an open standard, but under CCD2 it is defined more precisely. The assessment must in any event include relevant information on income and expenditure and be proportionate to the nature, duration, size and risks of the credit. In practice, this can be addressed by adopting a risk-based approach. For simple, low-risk credit products, a standardised assessment will suffice, while higher amounts or riskier products will require additional checks and documentation. Internally, organisations should make clear agreements in advance on which data sources are used, when a BKR consultation or additional evidence is required, and how exceptions are documented, so that decisions can be properly justified retrospectively.
Age verification for minors
Under the Dutch implementation of CCD2, buy now, pay later will be explicitly prohibited for minors. This means that organisations offering or facilitating BNPL must design their processes so that minors cannot access the service. Adequate age verification processes will therefore be required. Organisations may integrate age verification into their “know your customer” procedures, which are mandatory for credit providers under the Anti-Money Laundering and Counter-Terrorist Financing Act (Wwft).
Curious how CCD2 impacts your business or want to get ahead in compliance?