AML Compliance for Buy Now Pay Later (BNPL): What Fintechs Need to Know

Buy Now Pay Later companies occupy a complex position in the U.S. regulatory landscape. Their AML compliance obligations depend significantly on how their specific product is structured — and because BNPL products vary substantially in their design, the compliance analysis must be product-specific rather than categorical.

How Product Structure Affects AML Obligations

The key question for BNPL BSA compliance is whether the BNPL product involves money transmission.

BNPL products that involve direct fund disbursement — where the BNPL company sends money to the money transmitter definition applies — may qualify as money transmitters if the product is structured as a direct payment on behalf of the consumer. In this structure, the BNPL company is accepting funds (through the consumer's subsequent payments) and transmitting them (to the merchant), which is classic money transmission.

BNPL products that are pure credit extensions — where the BNPL company extends credit and the consumer repays over time — may not involve money transmission in the traditional sense. These products are more analogous to consumer lending than to payment transmission.

The distinction is fact-specific and requires legal analysis of the specific product structure, fund flow, and the legal relationships among the BNPL company, the consumer, and the merchant.

CFPB Consumer Protection Requirements for BNPL

Regardless of whether a BNPL product involves money transmission, it is subject to CFPB oversight. The CFPB has confirmed that many BNPL products are subject to Regulation Z as consumer credit products. This means BNPL companies must provide standardized credit disclosures, manage disputes and errors consistently with Regulation Z's requirements, and comply with the Equal Credit Opportunity Act's anti-discrimination standards in credit decisions.

KYC for BNPL Products

BNPL companies that qualify as money transmitters must implement full KYC at onboarding. BNPL companies that are primarily credit providers may have KYC obligations through the BSA or through lender-specific regulations depending on their product structure.

For most BNPL products, collecting and verifying customer identity before extending credit is both a compliance requirement and a risk management necessity — BNPL fraud is a significant and growing problem that proper KYC helps address.

Transaction Monitoring for BNPL

For BNPL products that involve money transmission, transaction monitoring must address the specific patterns relevant to BNPL — unusual patterns of transaction initiation, abnormal purchase amounts relative to customer history, rapid repeated use across multiple merchants, and patterns suggesting account takeover or synthetic identity fraud. The AML program must be specifically designed for the BNPL product's transaction flow.

Frequently Asked Questions

Does a BNPL company need a money transmitter license?

It depends on the specific product structure. BNPL products that involve money transmission require money transmitter licenses in states where customers are located. BNPL products structured purely as consumer credit extensions may require consumer lending licenses rather than money transmitter licenses. The specific licensing analysis requires review of the product design and applicable state laws.

How ComplyOne Helps

ComplyOne helps BNPL fintechs navigate their specific compliance obligations — from BSA/AML analysis through CFPB consumer protection and licensing — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.