EU Consumer Credit Directive 2 requirements for an overseas BNPL provider

The lender should contract with the consumer, approve the credit policy and make the lending decision. It should retain the receivable and control repayment changes, complaints and collection decisions. The merchant supplies the goods and sends delivery, cancellation and refund information. The South African company implements the agreed checkout and servicing technology. These are recommended contractual controls; actual conduct still determines each party’s regulatory role.

For the first product, use a fixed purchase plan repayable within three months, without consumer interest or charges. Adding fees, revolving limits, refinancing or receivable purchases requires another assessment. The repayment schedule must satisfy the statutory duration test; “pay in three” alone proves nothing. (Code de la consommation, art L.312-4-1; Code monétaire et financier, arts L.511-5 and L.519-1.)

France transposed CCD2 through Ordonnance n° 2025-880, amended by Ordonnance n° 2025-1154. Décrets n° 2026-105 (February 2026) and n° 2026-719 provide implementation detail. Décret n° 2026-643 modifies the February decree’s transition. These enacted measures take effect on 20 November 2026; the old rules govern until then within their existing scope.

Existing credit agreements generally remain under the previous law. Specified new provisions nevertheless apply to existing open-ended agreements. Separately, the February decree applies to offers issued from 20 November 2026; earlier offers receive its prescribed ongoing-contract treatment. That decree does not replace the ordinance’s contract-based transition. Record offer, acceptance and contract dates, and distinguish fixed plans from reusable credit facilities. (Ordonnance n° 2025-880, art 99; Ordonnance n° 2025-1154, art 7; Décret n° 2026-105, art 30, as amended; Décret n° 2026-719, art 12.)

Third-party pay in three remains credit

When the French lender advances credit and the consumer owes it instalments, merchant-funded economics do not create a supplier-deferral exclusion. France’s consumer-credit chapter covers credit up to €100,000, including free credit and amounts below €200, subject to its specific exclusions. (Code de la consommation, arts L.312-1 and L.312-4.)

Article L.312-4-1 gives partial relief to credit below €200 and qualifying credit repayable within three months. The latter must be free of interest and charges, or carry only negligible interest and charges. For these products, specified advertising details, mandatory consultation of the FICP (France’s national credit-incident database), the separate resources form and articles L.312-48 to L.312-53 do not apply. Core pre-contract information, creditworthiness assessment, withdrawal and early repayment remain. Do not equate exemption from consulting the FICP with exemption from assessing repayment capacity.

Longer, wholly free credit receives narrower statutory relief. A deferred-debit card has its own exclusion, including repayment within 40 days and restricted charges. Neither rule makes every short checkout plan exempt. (Code de la consommation, arts L.312-4, 11°, and L.312-4-1.)

Genuine merchant deferral has strict limits

For the ordinary supplier-deferral exclusion, the supplier itself allows payment later. No third party offers credit. Full payment must fall due within 50 days after delivery or service provision, without interest or other charges except limited late-payment charges.

A stricter rule applies when a large company concludes the distance contract electronically. Full payment must occur within 14 days after delivery or service provision. No third party may offer credit or purchase the resulting receivable. The December 2025 amendment expressly added that purchase restriction. (Code de la consommation, art L.312-4, 4°–5°; Ordonnance n° 2025-1154, art 1.)

Check the merchant’s statutory size classification and actual contracts. A settlement advance, guarantee or later assignment may change the analysis, depending on its substance. Count the period from delivery, not checkout. A merchant plan ending three months after delivery or service provision exceeds both exclusions. If the merchant itself provides in-scope credit, assess its creditor obligations and admission route; relabelling the lender’s fee as a merchant subsidy does not help.

Habitual lending in France generally requires an authorised credit institution or société de financement, subject to statutory exceptions. A South African incorporation or payment licence does not establish that permission. Verify the selected lender’s exact entity, authorisation and relevant activity before signing the launch agreement. (Code monétaire et financier, arts L.511-1, L.511-5 and L.511-10.)

France also provides an exception for merchants granting in-scope credit ancillary to their own commercial activity. Article L.511-6, 9°, provides for registration, with a registration exemption for qualifying micro, small and medium-sized suppliers offering specified interest-free deferrals. This does not give an independent BNPL lender a merchant permission. Where registration is required, the transitional period runs for six months from establishment of the register. Confirm its implementing arrangements before using that route; do not assume a fixed May 2027 deadline. (Code monétaire et financier, arts L.511-6, 9°, and L.511-7, I, 1°; Ordonnance n° 2025-1154, art 7, III.)

Presenting, proposing or helping conclude credit for remuneration or another economic benefit can constitute intermédiation en opérations de banque et en services de paiement (IOBSP). A checkout provider that solicits acceptance or helps complete the application needs this analysis even if it calls itself a software supplier. Registration with ORIAS (the French register of insurance, banking and finance intermediaries), the appropriate mandate and professional conditions may follow. Ancillary-merchant exemptions have specific conditions and thresholds; they are not a general platform exemption. (Code monétaire et financier, arts L.519-1 to L.519-3-3 and R.519-1 to R.519-2; arrêté du 7 août 2026.)

Keep payment execution with appropriately permitted providers. The technical-service exclusion requires the supplier never to possess the transferred funds and does not cover payment-initiation or account-information services. Licentium’s Payment & E-Money Licensing overview addresses that separate workstream. (Code monétaire et financier, art L.314-1, III, 7°.)

Servicing needs its own activity map. Technical reminders, collecting debts for another party and servicing acquired non-performing loans are different functions. Ordinary third-party collection rules and the special credit-servicer regime have different scopes. Leave collection decisions with the lender until the South African company’s proposed activity has been classified. (Code des procédures civiles d’exécution, arts R.124-1 to R.124-7; Code monétaire et financier, arts L.54-11-1 to L.54-11-3.)

Advertising and information before acceptance

Advertisements must be clear, fair and non-misleading. From 20 November 2026, the prescribed warning is: “Attention ! Un crédit coûte de l'argent et doit être remboursé”. Advertisements stating an interest rate or numerical information about credit cost trigger standard information requirements. The short-credit exemptions remove only specified particulars, and advertising must not emphasise how easily credit can be obtained. Apply lender-approved wording across merchant pages and platform screens. (Code de la consommation, arts L.312-5, L.312-6, L.312-8 and L.312-10.)

Keep clear, comprehensible general credit information permanently available free of charge on paper or another durable medium chosen by the consumer. Where the lender or intermediary makes it available at its premises, provide it at least on paper. (Code de la consommation, arts L.312-11-1 and R.312-1-1.)

Provide the fiche d’information précontractuelle européenne normalisée (FIPEN) in good time before the consumer becomes bound. Use a durable medium chosen by the borrower. If it arrives less than one day before the borrower is bound by a credit agreement or offer, send a withdrawal reminder between one and seven days after conclusion. This is not a compulsory 24-hour waiting period. (Code de la consommation, art L.312-12.)

The prescribed form’s core information occupies no more than two pages. Qualifying short and small credits omit the additional particulars identified in article R.312-2, but still need the core form. Provide free, adequate explanations of suitability, payment obligations and default consequences. Warn without charge where the borrower’s financial situation creates specific credit risks. Obtain express agreement without pre-ticked acceptance. Keep the offer open for at least 15 days; the customer need not wait 15 days to accept. (Code de la consommation, arts L.312-14, L.312-15-4, L.312-18, L.312-18-1 and R.312-2.)

Provide a separate credit agreement on paper or another durable medium, with the required opening box of essential terms. Its presentation must remain readable on the electronic medium used. Clearly notify the borrower if automated processing of personal data personalises the offer. (Code de la consommation, arts L.312-13, L.312-28 and R.312-10.)

Affordability and automated assessment

Before concluding the agreement, the lender must conduct a thorough creditworthiness assessment. Use relevant, accurate income, expenditure and other financial information proportionate to the credit’s nature, duration, amount and risk. Verify the information, using documents beyond those supplied by the borrower where necessary. Social-network information and special-category personal data cannot supply the assessment. Lend only where the result supports repayment according to the contract. A successful card authorisation is not that assessment. (Code de la consommation, art L.312-16, I–VI.)

Document the assessment procedure and retain the information used throughout the agreement, consistently with data-protection law. The South African company should preserve the inputs, policy version and decision record needed by the lender. (Code de la consommation, art D.312-6-1.)

Where automated processing supports the assessment, French law requires information about human intervention, an intelligible explanation and the right to express a view and request reassessment. Give prompt notice of rejection, including the required database information where relevant. These duties cannot wait for a separate AI compliance project. (Code de la consommation, art L.312-16, VIII–IX.)

GDPR separately restricts solely automated decisions with legal or similarly significant effects. Identify an applicable exception and safeguards, or provide meaningful human decision-making. A supplier’s score can itself fall within that rule where it determines the lender’s decision. Explanations must describe the process actually used; a complex formula alone is insufficient. (GDPR, arts 15(1)(h) and 22; CJUE, C-634/21, SCHUFA, paras 43, 48–54 and 73; C-203/22, Dun & Bradstreet Austria, paras 58–66.)

The wider system-classification work belongs in the separate EU AI Act credit-scoring analysis.

Withdrawal, early repayment and purchase refunds

The ordinary credit-withdrawal period is 14 calendar days, beginning with acceptance and the required information, or later receipt of the contractual terms and information. Missing disclosures can extend the period. For linked credit financing goods, a seller’s guaranteed full-refund return period exceeding 14 days can extend credit withdrawal, capped by the credit’s duration. (Code de la consommation, arts L.312-19 and L.312-20.)

Withdrawal from credit does not erase money already advanced. The borrower generally repays principal and accrued interest without undue delay, within 30 days after sending the withdrawal notice to the lender. Separately, early repayment reduces the remaining cost of credit. Compensation cannot exceed the interest that would otherwise have been paid, so a zero-interest plan cannot generate that compensation. (Code de la consommation, arts L.312-26 and L.312-34.)

From 20 November 2026, article L.312-25 prohibits payment before acceptance and removes the general seven-day post-acceptance funding restriction. Seller delivery rules still require separate handling. An express request for immediate delivery does not remove the ordinary credit-withdrawal right. (Code de la consommation, arts L.312-25 and L.312-47.)

An integrated checkout loan financing identified goods will ordinarily be crédit affecté, or linked credit. The statutory definition requires exclusive financing and a commercial unit between the agreements. Qualifying short loans exclude articles L.312-48 to L.312-53. Consequently, do not promise that withdrawing from the credit automatically cancels the purchase under article L.312-52. (Code de la consommation, arts L.311-1, 11°, and L.312-4-1.)

Other linked-credit protections remain. Lawful withdrawal from the purchase terminates the linked credit under article L.312-54, subject to its limited file-opening-cost exception. Article L.312-55 provides remedies for sales disputes and judicial cancellation. Build separate customer options for credit withdrawal and purchase returns. Connect each loan to its order, record partial refunds and reconcile merchant payments. Contractually pause disputed collections where appropriate, and prevent duplicate recovery. A merchant indemnity cannot remove the consumer’s statutory rights.

At the first missed repayment, the lender must give the prescribed warning about the risks on a durable medium. Before enforcement, it must allow a reasonable period and offer suitable renegotiation measures where appropriate. It must detect payment difficulty and provide access to independent debt advice. The implementing rules require a referral when the specified reportable FICP payment incident occurs. They do not impose a universal fixed grace period for every missed instalment. (Code de la consommation, arts L.312-35-1, L.312-35-2, L.312-36 and D.312-36.)

Give the lender an accessible complaints route, escalation records and control of outcomes. Consumers must have effective access to free consumer mediation. Display the competent mediator’s details and website as required, including in the relevant online and contractual information. The service agreement should make merchant and technology teams supply evidence promptly. (Code de la consommation, arts L.612-1, L.616-1 and R.616-1.)

The partner agreement should allocate underwriting, disclosures, acceptance evidence, withdrawal notices, refunds, hardship decisions and reporting. It should also control subcontracting, security, incidents, audit access, business continuity and exit. Define which actions need lender approval and how the lender retrieves complete records. These are implementation controls supporting the statutory allocation; a responsibility schedule does not transfer mandatory consumer duties away from their legal bearer. (Code de la consommation, arts L.312-12, L.312-16 and L.312-27; GDPR, arts 28 and 32.)

Where the lender and service fall within the Digital Operational Resilience Act, the contract for information and communication technology services must meet its written-contract requirements. Services supporting critical or important functions attract additional requirements, including audit access, continuity and exit arrangements. Confirm the lender’s entity category before applying that regime. (Regulation (EU) 2022/2554, arts 2, 28 and 30.)

Map GDPR roles by actual decisions about processing. Complete the processor agreement and a lawful transfer mechanism before a separate South African company accesses French customer data. South Africa has no EU adequacy decision. Standard contractual clauses require the applicable transfer assessment and safeguards. The Protection of Personal Information Act’s security and operator requirements need separate application; its outward-transfer provision does not authorise an EU export. (GDPR, arts 28 and 44–46; Commission Implementing Decision (EU) 2021/914, annex, cl 14; Protection of Personal Information Act 4 of 2013, ss 3, 19–21 and 72.)

South African credit-law scope also needs a factual check. The National Credit Act covers qualifying agreements made within, or having an effect within, South Africa. French borrowers alone do not settle that test. Keeping the company’s role technical avoids assuming that it may originate credit from South Africa. Review any retained lending, funding or receivable ownership separately. Ask its authorised dealer to check the actual cross-border fee and funding flows before settlement. (National Credit Act 34 of 2005, s 4; South African Reserve Bank, Currency and Exchanges Manual for Authorised Dealers, Introduction, p 15.)

For each additional EU country, reopen product scope, creditor admission, intermediary registration, local disclosures, affordability, complaints, language and enforcement. Check any actual passport and notification route belonging to the chosen lender. A French non-bank permission does not become a general EU permission through CCD2. Choosing another governing law also cannot remove protected consumers’ mandatory home-country protections where Rome I article 6 applies. (Directive (EU) 2023/2225, arts 2 and 37; Regulation (EC) 593/2008, art 6.)

1. Product and permissions: approve the complete fee schedule, repayment dates, merchant classification, creditor identity and each intermediary or payment role.
2. Customer documents: approve the French advertisements, general credit information, FIPEN, credit terms, explanations, withdrawal form, privacy information and mediator details.
3. Decision process: evidence proportionate affordability checks, automated-decision safeguards, human reassessment and retained records.
4. Money and goods: test acceptance, funding, delivery requests, cancellations, partial refunds, early repayment and failed-payment reconciliation.
5. Operating ownership: sign the merchant, lender, technology and data schedules; test complaints, hardship escalation, incidents and exit.

The launch recommendation changes if the company lends, acquires receivables, collects debts, initiates payments or reuses personal data for its own purposes. Treat each change as a new approval decision before enabling it.

For the separate UK route, see UK launch choices for a South African BNPL business. Licentium’s BNPL market-entry support describes the permission map and implementation documents for a country-specific engagement.