OCC Issues Risk Management Guidance for BNPL Lending

Cooley alert
December 12, 2023

On December 6, 2023, the Office of the Comptroller of the Currency (OCC) issued a bulletin that provides guidance to banks on managing risks associated with certain “buy now, pay later” (BNPL) loans. While the OCC notes that BNPL loans can provide consumers with a “low-cost, short-term, small-dollar financing alternative to manage cash flow,” it warns that BNPL lending can result in risks to consumers, as well as “credit, compliance, operational, strategic, and reputation risks” to banks, and that such risks should be mitigated.

The OCC bulletin specifically applies to loans that are repayable in four or fewer installments with no finance charges (i.e., no interest and no other finance charges). The OCC clarifies that the guidance does not apply to “traditional” installment loans, meaning loans repayable in more than four installments, or loans that charge interest or have other finance charges.

Potential risks highlighted by the OCC

The OCC highlights potential risks for borrowers and banks that stem from BNPL lending, including:

Risk to borrowers

  • Overextension risk: Borrowers may overextend themselves, because they may not fully understand BNPL repayment obligations – in part due to the lack of standardized disclosure requirements.
  • Secondary fees: Because borrower loan payments associated with BNPL lending are generally tied to a debit or credit card, there is a follow-on risk due to overextension that can result in secondary fees charged to the borrower, such as overdraft or late fees.
  • Other issues: Borrowers may experience issues with respect to returns associated with merchandise purchased by the borrower in connection with a BNPL loan. In addition, resulting merchant disputes can be potentially troublesome for BNPL borrowers and banks, because disputes between a borrower and a merchant may not be resolved during the limited time period of a BNPL loan term.

Risk to banks

  • Credit risk: Creditors may not know of a borrower’s existing credit obligations and a borrower’s actual ability to repay, because BNPL loans may not be fully captured in borrower credit histories.
  • Third-party relationship risk: Some banks contract directly with merchants to offer BNPL loans, while others may work with a third-party BNPL provider to intermediate with merchants. Third-party relationships may pose operational and compliance risk in situations where the bank does not directly control third-party activity.
  • Default risk: Risk of default may arise, such as due to fraud.

OCC guidance for managing risk

To manage risks from BNPL lending, the OCC notes that “[b]anks engaging in BNPL lending should do so within a risk management system that is commensurate with associated risks.” Specifically, the OCC states that banks “should maintain underwriting, repayment terms, pricing, and safeguards that minimize adverse customer outcomes” and should ensure marketing materials include appropriate disclosures that are clear and conspicuous. More specifically, the OCC suggests the following to assist banks in mitigating risk:

Credit risk management

Banks should establish policies and procedures for BNPL lending that – among other elements – cover loan terms, underwriting criteria and fees. Specifically, “BNPL underwriting criteria and repayment assessment methodologies should provide reasonable assurance that the borrower can repay the debt.”

Operational risk management

Banks should address operational risk in a number of ways, including:

  • Establishing processes for handling merchandise returns and merchant disputes.
  • Maintaining ongoing monitoring and reporting for BNPL loans.
  • Considering developing BNPL-specific fraud detection and mitigation systems.
  • Incorporating third-party models into the bank’s risk management process.

Third-party risk management

Banks should remain cognizant of the compliance liabilities stemming from violations made by third-party partners and monitor their partners appropriately. The OCC “expects a bank to have risk management processes to effectively manage the risks arising from its activities, including from third-party relationships,” and a bank “that partners with a third party, including a merchant, to offer BNPL loans should incorporate that relationship into the bank’s third-party risk management processes.” The OCC instructs banks to refer to recent interagency guidance on managing risks associated with third-party relationships.

Compliance risk management

Bank management “should determine the applicability of consumer protection-related laws and regulations to the bank’s specific BNPL offerings,” such as the Equal Credit Opportunity Act, the Electronic Fund Transfer Act, the Fair Credit Reporting Act, and the prohibition on unfair, deceptive, or abusive acts or practices. Banks should consider whether and how consumer protection laws – including with respect to product delivery methods, marketing and advertising – apply to BNPL loans, and review all aspects of marketing, advertising and consumer disclosures to ensure that they clearly state a borrower’s obligations under the loan agreement. Banks also should review billing dispute and error resolution rights and policies and procedures surrounding automatic payments, multiple payment representments and fees (including late fees). Finally, BNPL lending should be included in the bank’s compliance management system.

Industrywide credit reporting

The OCC suggests that industrywide, consistent credit bureau reporting would help banks manage credit risk while allowing borrowers who make payments on time to build credit history.

Continued regulatory focus on BNPL loans

The OCC’s guidance demonstrates continued regulatory focus on BNPL lending. The Consumer Financial Protection Bureau (CFPB) also has been active in reviewing the BNPL market – including by releasing September 2022 and March 2023 reports on BNPL products – and Director Rohit Chopra has instructed CFPB staff to “identify potential interpretive guidance or rules to issue with the goal of ensuring that Buy Now, Pay Later firms adhere to many of the baseline protections that Congress has already established for credit cards.”

Parties involved in BNPL lending should continue to review their policies and procedures for compliance in this evolving space and expect continued scrutiny of – and the potential for further federal regulation of – BNPL products.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.