Buy Now Pay Later App Development: Architecture and Compliance
The Federal Reserve found that 16% of US adults used buy now pay later in 2025, and regulators are catching up. The UK began regulating BNPL lending on July 15, 2026, and the EU’s revised Consumer Credit Directive applies from November 20, 2026. This guide, part of our guide to fintech app development cost, explains the architecture a BNPL app needs and how each rule changes the build.
Quick answer
A BNPL app is a lending system with a checkout front end. It needs merchant integration, real-time eligibility decisions, an installment ledger, collections, and regulated disclosures. Rules set the design: the UK has regulated BNPL lending since July 15, 2026, and the EU’s Consumer Credit Directive applies from November 20, 2026.
A BNPL app is a lending system with a checkout front end it decides, lends, and collects in seconds
1. What Is a BNPL App, and What Must It Do?
A buy now, pay later app lets a shopper split a purchase into installments at checkout, and it works as a lending system with a payments front end. It must decide in seconds whether to lend, carry a repayment schedule for weeks or months, collect each payment, and keep a record of every decision for regulators.
The Federal Reserve’s 2025 household survey found that 16% of US adults used BNPL, up one point from 2024, and that 11% of BNPL users had a payment trigger an overdraft or non-sufficient funds fee. The second figure shows why affordability checks and payment timing are product decisions as much as compliance tasks.
Your first design decision is who lends. A merchant can offer its own installments, a licensed lender can fund loans behind your app, or you can become the lender. That choice decides which licenses, capital rules, and regulators apply, and the software follows it.
2. Which Rules Shape a BNPL Build?
Rules differ by market, and several changed within the last year. The UK made BNPL a regulated activity on July 15, 2026. The EU’s revised Consumer Credit Directive applies from November 20, 2026 and ends the exemption for third-party BNPL providers. In the US, federal oversight stepped back while New York moved ahead.
| Market | Status | What the software must support |
| UK | FCA policy statement PS26/1 (February 11, 2026). Deferred payment credit lending is regulated from July 15, 2026; firms without permissions registered for the Temporary Permissions Regime from May 15. | Creditworthiness checks on every agreement, including £50 or less; a statement of whether a credit reference check will or may be used; a missed-payment message as soon as possible; senior manager accountability |
| EU | Directive (EU) 2023/2225 applies from November 20, 2026. National laws implement it, so details vary by country. | No exemption for third-party BNPL; the €200 minimum is removed; a creditworthiness assessment before the agreement; the warning “Borrowing money costs money” in adverts; a standard pre-contract form of one to two pages |
| US | The CFPB’s 2024 interpretive rule was rescinded in May 2025. New York’s BNPL Act (signed May 9, 2025) is not yet in force; the state issued a proposed rule on July 15, 2026. | Under the New York proposal: licensing, risk-based underwriting of income and debts, Regulation Z-style cost disclosures, a 16% interest cap, and a reasonably accessible interface for allocating payments and prepaying |
| Vietnam | No dedicated BNPL law was found in the sources reviewed. A 2022 law-firm note said lending is generally restricted for non-bank entities. FiinGroup counted 15 active platforms in 2024, up from four in 2020. | Confirm current licensing and who may lend with Vietnamese counsel before design; keep rules configurable |
Because the rules vary, treat disclosures, fees, retry limits, and credit checks as configuration by market, not hard-coded logic. A product built for one state or country may need changes for the next, as New York’s requirement that borrowers can allocate payments and prepay installments shows.
BNPL regulation moved fast in 2026: the UK and EU both introduced binding rules within months of each other
3. What Architecture Does a BNPL App Need?
A BNPL platform has seven building blocks: checkout integration, eligibility decisioning, an installment ledger, payments and collections, customer communications, servicing and disputes, and compliance reporting. Design the ledger and the decision log first, because every other part reads from them and regulators ask to see them.
Checkout integration
SDK, hosted payment page, or API with webhooks so merchants offer installments at checkout.
⚠ Scripts on payment pages fall under PCI DSS requirements. 6.4.3 and 11.6.1
Eligibility decisioning
Real-time approval, decline, or limit decisions from identity, credit, and bank data.
⚠ Log inputs, rules, and outcome for each decision; the FCA notes Open Banking data can help with thin credit files
Installment ledger
Schedule, fees, refunds, returns, and balances in a double-entry ledger.
⚠ Handle partial refunds and changed schedules without rewriting history
Payments and collections
Tokenized card or bank debit on due dates, retries, and reminders.
⚠ Retry limits differ by market; New York’s February 2026 draft allowed two attempts per method without new authorization
Customer communications
Pre-contract information, confirmations, statements, and missed-payment notices.
⚠ Content and timing are regulated, such as the UK missed-payment message
Servicing and disputes
Refunds, disputes, hardship support, and complaints.
⚠ UK lenders must signpost free debt advice with notices of intent to enforce or terminate
Compliance and reporting
Audit trail, regulatory returns, credit bureau reporting, and financial reporting.
⚠ Store the disclosures and consent shown at the time of each agreement
Should You Build or Buy Each Part?
Build the parts that set you apart, usually decisioning and the customer experience, and consider buying or partnering for commodity parts such as payment processing. Licensing, funding, and capital are not software problems, so settle the lending model first. Then choose components that expose a full audit trail and configurable rules.
This comparison is editorial, not a vendor ranking. Check each provider’s market coverage and whether it holds the licenses your model needs.
4. What Security and Data Duties Apply?
BNPL apps handle card data, bank data, and credit decisions, so security covers three layers: payment pages, stored data, and decision records. PCI DSS version 4.0.1 made its future-dated requirements mandatory on March 31, 2025, including script controls on payment pages, which matter for checkout widgets embedded in merchant sites.
- Payment pages. Requirements 6.4.3 and 11.6.1 call for payment page scripts to be authorized, checked for integrity, and monitored for tampering.
- Stored data. Store payment tokens rather than card numbers wherever your processor allows, and limit who can read credit data.
- Data use. New York’s February 2026 draft limited sharing of non-public consumer data to informed, use-specific consent lasting one year, and barred conditioning credit on that consent.
- Decision records. Keep the inputs and outcome of each credit decision so you can answer a complaint or an examiner.
5. What Does Savvycom’s Payments and Banking Work Show?
Savvycom has not published a buy now pay later project, so the closest evidence is banking and financial-control work. For a Cambodian bank it built native iOS and Android apps with APIs for real-time core banking synchronization, two-factor authentication, and AES-256 encryption. The bank reported 61.5% user adoption and 99% user satisfaction.
The foreign exchange assistant Savvycom built for a South Korean financial services company shows controls that carry over to lending: trades tied to a locked quote, role-based access, and automatic logging of every transaction. In a BNPL app the same ideas fix the terms a customer accepted, limit who can change a schedule, and log each action. It went live in three months. Read the multi-agent FX project for details.
Neither project is a lending or BNPL product, and the public pages do not describe credit decisioning or collections. Treat them as evidence of banking integration and control design, not of BNPL delivery.
6. What Should You Ask a BNPL Development Partner?
Ask a partner to show experience with lending products in the markets you serve, not only payments in general. A useful partner can explain how it separates rules from code, logs credit decisions, handles refunds against a schedule, and tests failure cases such as declined debits, duplicate webhooks, and changed due dates.
-
- Lending model. Which model have they built for: merchant, licensed partner, or own license?
- Rules. How do they change disclosures, fees, and retry limits by market without a release?
- Decisioning. How do they log and explain a decline?
- Ledger. How do they handle partial refunds and rescheduled payments?
- Operations. Who monitors collections, disputes, and regulatory changes after launch?
7. Frequently Asked Questions
