Consumer fintechLicence required

BNPL platform testing

FintechAssuranceLabs tests pay-in-4 and pay-monthly platforms, the model behind products like Klarna, Affirm, and Afterpay, from the checkout credit decision to the final instalment. FintechAssuranceLabs test scope covers instalment schedules, merchant fee and refund calculations, late fee rules, affordability checks, repayment collection by card and bank debit, and the evidence a state regulator or partner bank requests.

What breaks in BNPL money flows

A BNPL provider earns a merchant fee on each approved order, late fees on missed instalments, and interest on pay-monthly plans. Each defect below repeats for every order in the batch.

Merchant refund held until the weekly settlement run. The merchant refunds an order on Monday, but the refund credit posts to the consumer's plan only when the weekly merchant settlement batch nets refunds against the merchant fee. Autopay collects the next instalment in full, and the over-collection becomes a credit balance. New York's proposed 3 NYCRR 423.12(c) would require the lender to credit the consumer's account within three business days of receiving the merchant's credit statement and to refund a credit balance within three business days (NYDFS proposed rule text, July 2026).
A late fee for every failed retry. A card repayment declines, the retry job presents the same instalment again two days later, and the fee engine charges a new late fee on each failed attempt. The proposed New York rule would allow one penalty fee per event (423.9(b)(2)(ii)), an $8 safe harbor per fee unless the superintendent approves a cost-based amount (423.9(b)(1)), and total penalty fees no higher than the original amount financed (423.9(b)(2)(iii)). In the EU, Article 35(4) of the Consumer Credit Directive (EU) 2023/2225 (CCD2) requires Member States that allow additional default charges to cap them, so the fee engine carries a cap per market.
Payment extension that turns a pay-in-4 plan into a Regulation Z credit. A "pay later" option splits the remaining balance of a four-payment plan into six more payments, and an extension fee is added to the schedule. Under 12 CFR 1026.2(a)(17)(i), a person who regularly extends consumer credit with a finance charge or payable by written agreement in more than four instalments, not counting a down payment, is a creditor. A lender that offers the option as a standard feature can meet that test, and plans on the extended terms then need the closed-end disclosures in 1026.17 and 1026.18, which a pay-in-4 checkout never generates. See Regulation Z testing requirements.
Affordability check that fails open. The credit bureau or bank data call times out at checkout, and the decision service approves the order so the merchant fee is not lost. The provider carries the credit loss on unpaid instalments. CCD2 Article 18(6) requires Member States to ensure that the creditor makes credit available only when the creditworthiness assessment indicates the consumer is likely to meet the obligations. In the US, a declined pay-monthly application with a finance charge needs a notice within 30 days under 12 CFR 1002.9(a)(1)(i). An interest-free plan in four or fewer instalments is incidental credit, which 1002.3(c)(2)(vi) exempts from the 1002.9 notice rules, so the notice logic has to branch by plan type; see Regulation B.
Merchant fee rate read at settlement instead of at order. A merchant moves to a lower fee tier on the first of the month, and orders placed in the last days of the previous month settle at the new rate. Merchant statements no longer match the contract, and every affected order is recalculated and rebilled.

Licence flag and the evidence regulators and partner banks ask for

BNPL carries a licence flag: the provider extends consumer credit under its own lending licence or through a partner bank. Sources on this page were checked on 2026-09-16.

United States

The CFPB withdrew its 2024 interpretive rule that treated pay-later digital accounts as credit cards on 12 May 2025 (90 FR 20084), so that rule is not a basis for supervision. Regulation Z applies when the lender meets the 1026.2(a)(17) creditor test. Regulation B covers every BNPL credit decision, because it defines credit as the right to defer payment of a debt (1002.2(j)), with the incidental credit exemptions in 1002.3(c)(2) for interest-free plans of four or fewer instalments.

New York enacted a BNPL licensing law in Banking Law article 14-B in 2025. The Department of Financial Services published the implementing proposal, new 3 NYCRR Part 423, in the State Register on 15 July 2026, and its comment period closed on 14 September 2026 (NYDFS regulatory activity). The proposal is not final. As proposed, it would require risk-based underwriting that assesses income and indebtedness before each loan (423.12(b)), and it would bar a late fee unless the lender sent a due date notice at least seven days before the due date (423.9(b)(2)(iv)).

A partner bank reviews the BNPL programme as a third-party relationship under the Interagency Guidance on Third-Party Relationships (88 FR 37920, 9 June 2023). Evidence regulators and banks request:

fee calculation test records per plan type, with late fee amount, count per event, and cumulative total;
adverse action notice logs with decision time and send time per declined application on plans outside the incidental credit exemption;
refund and credit balance timelines from merchant credit statement to consumer credit;
disclosure samples for any plan that meets the Regulation Z creditor test.

European Union

CCD2 brings third-party BNPL into scope: the Article 2(2)(h) exclusion covers only deferred payment offered by the seller itself, with no third party offering credit, free of interest and charges other than limited late payment charges, and paid within 50 days of delivery (14 days for online sellers that are not micro, small, or medium-sized enterprises). Member States apply their national measures from 20 November 2026 (Article 48(1)). Creditors that are not banks, payment institutions, or e-money institutions need admission, registration, and supervision by a national competent authority (Article 37). Evidence that authority can request:

the Standard European Consumer Credit Information form produced per plan type (Article 10(2), Annex I);
documented creditworthiness procedures and the information used per decision (Article 18(4));
human review records where the assessment is automated (Article 18(8));
withdrawal handling within 14 calendar days (Article 26) and forbearance policies applied before enforcement (Article 35(1)).

BNPL test scenarios

Instalment schedule generation. Order totals that do not divide evenly into four, with the rounding remainder placed on the instalment the terms name. The banker's rounding guide covers the rounding modes.
Due dates. Schedules created at month end and due dates that fall on a weekend or bank holiday.
Partial and full refunds. Refunds before the first instalment, between instalments, and after the final one, checked against the schedule, the credit balance, and the merchant fee reversal.
Late fee rules. One missed instalment with two failed retries, a missed instalment on a plan already at its fee cap, and a payment received on the due date after the fee job has run.
Autopay off. The checkout path with autopay switched off still offers the plan, because 12 CFR 1005.10(e)(1) prohibits conditioning credit on repayment by preauthorized electronic fund transfer.
Varying debit amounts. A refund that changes the next preauthorized debit triggers the notice of amount and date at least 10 days before the transfer (1005.10(d)(1)), unless the consumer chose the range option in 1005.10(d)(2).
Affordability decisions. Bureau timeout, bank data consent withdrawn mid-flow, and thin-file applicants, with the decision per path and the adverse action notice per plan type.
Merchant fee calculation. Fee tier changes at month end, zero-fee campaigns, and orders with shipping and tax, recalculated against the merchant contract by financial calculation testing.
Payment extension. An extension on an interest-free plan, checked for fee classification, instalment count, and the disclosures the new terms require.

Integrations and protocols to cover

Merchant checkout. E-commerce platform plugins, hosted checkout redirects, and order APIs with idempotent order creation.
Card repayments. Card-on-file charges through a card processor, token lifecycle, and network decline codes. Stored card numbers are cardholder data under PCI DSS; see how we handle cardholder data.
Bank debits. Nacha WEB debit entries with account validation before first use, return codes, and reinitiation rules, covered in the Nacha return code testing guide. In the EU, SEPA Direct Debit collections as ISO 20022 pain.008 files with mandate data.
Merchant settlement. Settlement and payout files that net refunds and merchant fees, sent as ACH credits or ISO 20022 pain.001 credit transfers, reconciled against the lender's ledger.
Virtual cards for in-store plans. Card issuing processor authorisation webhooks for single-use cards, matched to the plan that funds them.
Credit data. Credit bureau inquiry APIs, open banking account data APIs for affordability, and Metro 2 furnishing files where the provider reports plans to bureaus.
Identity and screening. KYC vendor APIs and sanctions screening at account creation, with timeout behaviour per decision path.

Standards

Services

Guides

Blog posts

Sample deliverable

Sample, synthetic data

defect log with financial impactDefect log with financial impact: lending, BNPL, and wallet release test

Defect log with financial impact: lending, BNPL, and wallet release test
ID	Flow	Defect	Severity and status	Financial impact (XTS) and basis	Rule touched
DEF-101	Instalment loan interest accrual	Daily interest uses a 360-day year while the loan agreement and the APR disclosure use a 365-day year, so a 20.00% nominal loan accrues at about 20.28%	Critical; fixed, retest passed	1.14 overcharged per affected loan per 30 days at 5,000.00 principal	12 CFR 1026.22(a)(2): APR accurate within 1/8 of 1 percentage point
DEF-102	Credit line repayment	App payments received after 16:00 on the due date are credited the next day and trigger a late fee	Critical; open	25.00 late fee charged in error per affected account per billing cycle	12 CFR 1026.10(b)(2)(ii): payment cut-off no earlier than 5 p.m. on the due date
DEF-103	Instalment loan early payoff	Payoff quote adds a prepayment fee while the loan disclosure states that no prepayment charge applies	Major; fixed, retest passed	50.00 charged in error per affected early payoff	12 CFR 1026.18(k)(1): prepayment charge disclosure
DEF-104	Loan application decisioning	Applications declined after a decision service timeout stay in pending status and no adverse action notice is sent	Major; open	0.00 direct loss per affected applicant; the exposure is regulatory	12 CFR 1002.9(a)(1)(i): notice of action within 30 days of a completed application
DEF-105	BNPL merchant fee calculation	Merchant fee at 5.99% is calculated on the order total including shipping, while the merchant fee schedule excludes shipping	Major; fixed, retest passed	0.90 overcharged per affected order with 15.00 shipping	No regulation clause; merchant fee schedule
DEF-106	BNPL partial refund	A 40.00 partial refund reduces the last instalment instead of the next instalments, so the next instalment is collected in full	Minor; deferred to the next release with a manual adjustment procedure	40.00 collected early per affected order until the final instalment date	No regulation clause; customer instalment agreement
DEF-107	Wallet peer-to-peer transfer	A transfer retried after a client timeout is sent with a new idempotency key, so the wallet balance is debited twice	Blocker; fixed, retest passed	60.00 debited in error per duplicated transfer in the test case	12 CFR 1005.11(a)(1)(ii): incorrect electronic fund transfer
DEF-108	Wallet dispute handling	The provisional credit job skips disputes received on a weekend, so the credit posts on business day 11	Critical; open	150.00 held one business day too long per affected dispute	12 CFR 1005.11(c)(2)(i): provisional credit within 10 business days

Amounts use XTS, the ISO 4217 code reserved for testing. Loans, orders, wallets, and disputes are generated test records with no customer data.

Questions

What is pay in 4?

Pay in 4 is a buy now pay later plan that splits a purchase into four instalments, usually the first at checkout and the rest every two weeks, often with no interest. Under US Regulation Z, a lender whose plans carry no finance charge and are payable in four or fewer instalments is outside the creditor definition in 12 CFR 1026.2(a)(17)(i).

How do BNPL companies make money?

Buy now pay later providers earn mainly from a merchant fee, deducted from the order amount when the provider settles with the merchant. Buy now pay later providers also charge late fees on missed instalments where the loan terms and local law allow them, and charge interest on longer pay-monthly plans.

How does BNPL work?

At checkout, a buy now pay later provider runs a credit or affordability check and, on approval, pays the merchant the order amount minus a merchant fee. The consumer repays the provider in scheduled instalments, usually by card or bank debit, and a merchant refund reduces the amount the consumer still owes.

Scope your BNPL release testing

Send your plan types, repayment methods, and target markets, and we return a test scope covering instalment, fee, refund, and credit decision flows with the evidence each one needs.

Scope your testing