BNPL 2.0: What the Consumer Credit Act 2025 Means for Merchant Liability

For the past few years, “Buy Now, Pay Later” (BNPL) has flourished in Malaysia as a largely unregulated financial product. It provided a seamless way for merchants to increase basket sizes and for consumers to access credit without the rigour of traditional banking. However, this era of “BNPL 1.0” is coming to a close.

The implementation of the Consumer Credit Act (CCA) 2025 marks the transition to BNPL 2.0. Under the oversight of the newly formed Consumer Credit Oversight Board (CCOB), BNPL providers—and the merchants who partner with them—now face a much more stringent regulatory environment.

For merchants, this isn’t just a change for your providers; it fundamentally alters your liability, your marketing responsibilities, and how you handle customer disputes. This guide explores what the CCA 2025 means for your business and how to ensure your checkout remains compliant.

Key Takeaways

• Regulated Oversight: The CCOB now regulates all non-bank credit providers, including BNPL firms, ensuring they follow fair lending practices.
• Transparent Disclosure: Merchants must ensure that the “total cost of credit” is clearly disclosed to customers at the point of sale.
• Marketing Responsibility: Misleading advertising or “aggressive” sales tactics that push consumers into debt can now lead to direct penalties for the merchant.
• Shared Liability for Disputes: Under the new act, merchants may share more responsibility with providers regarding refunds, defective goods, and service failures.
• Affordability Assessments: Providers are now required to conduct more rigorous credit checks, which may impact your conversion rates but reduces your risk of dealing with defaulted payments.

What is the Consumer Credit Act (CCA) 2025?

The CCA 2025 was established to protect Malaysian consumers from predatory lending and over-indebtedness. Historically, BNPL didn’t fall under the same rules as credit cards or personal loans. The CCA closes this loophole, bringing BNPL under the same umbrella of protection.

The CCOB (Consumer Credit Oversight Board), led by the Ministry of Finance and Bank Negara Malaysia, acts as the primary regulator. Their goal is to ensure that credit is provided responsibly and that consumers are treated fairly throughout the lifecycle of the debt.

3 Ways the CCA 2025 Impacts Merchant Liability

While the BNPL provider (the “Lender”) carries the bulk of the regulatory weight, the merchant (the “Agent”) is no longer a silent partner.

1. Liability for Misrepresentation and Quality

In the past, if a customer bought a defective product using BNPL, the merchant often told the customer to “talk to the BNPL provider,” while the provider told them to “talk to the merchant.”

Under BNPL 2.0, there is a push toward joint and several liability. This means that if a merchant misrepresents a product or provides faulty goods, the consumer has stronger legal grounds to halt payments or demand a refund, and the CCOB can hold the merchant accountable for their role in the credit-linked sale.

2. Marketing and “Nudging” Compliance

The CCA 2025 introduces strict rules on how credit is marketed. Merchants can no longer use “dark patterns”—UI designs that trick users into selecting BNPL by default.

• The Trap: Offering a discount only if the user selects BNPL without clearly explaining the interest or late fees.
• The Fix: You must provide clear, prominent information on late fees, interest rates, and the total amount the customer will pay.

3. Data Privacy and Collection

The act reinforces the Personal Data Protection Act (PDPA). Merchants must be transparent about how customer data is shared with BNPL providers for credit scoring. Improper data handling between your checkout and the provider now carries higher regulatory risk.

Did You Know?

According to the CCOB, the “Buy Now, Pay Later” sector in Malaysia saw a massive surge in volume leading up to 2024. However, a significant portion of users were under the age of 30, many of whom were unaware of the impact late payments could have on their long-term credit health. The CCA 2025 specifically aims to protect this younger demographic from “debt traps.”

The Role of Digital Infrastructure in Regulatory Alignment

As the regulatory landscape tightens, the quality of a business’s digital financial infrastructure becomes its primary defence against compliance risks. Modern financial systems support the transition to BNPL 2.0 through several key technological advantages:

• Adherence to Standardised Oversight: Using financial systems that integrate with credit providers already aligned with CCOB standards ensures that the payment methods offered are legally sound and compliant with Malaysian law.
• Enhanced Disclosure at Checkout: Digital checkout flows designed for transparency allow merchants to meet the strict “total cost of credit” disclosure requirements. This ensures that late fees, interest rates, and total repayment amounts are clear to the consumer without sacrificing the speed of the transaction.
• Streamlined Dispute Resolution: By maintaining a unified digital trail of e-invoices, credit agreements, and payments in one central system, merchants can handle refunds and disputes more efficiently. This visibility is crucial for maintaining the rigorous audit trail required by the CCOB.

Ready to Navigate the Future of Malaysian Credit?

Compliance is a competitive advantage. Ensure your business is ready for the era of regulated credit with a payment partner that understands the Malaysian landscape.

Explore Compliant Payment Solutions from Razorpay Curlec

Conclusion: Compliance as a Brand Asset

The move to BNPL 2.0 under the Consumer Credit Act 2025 may seem like a burden, but it is ultimately a step toward a more sustainable and trustworthy digital economy. For Malaysian merchants, compliance isn’t just about avoiding fines; it’s about protecting your customers. By being transparent about costs, responsible in your marketing, and efficient in your dispute resolution, you build the kind of brand trust that lasts far longer than any single transaction.

Frequently Asked Questions (FAQs)

Does my business need a license from CCOB to offer BNPL?

Generally, the BNPL provider (the one providing the credit) needs the license. However, as a merchant, you are an “agent” of that credit. While you don’t need a lending license, you must comply with the CCOB’s guidelines on marketing, disclosure, and fair treatment of consumers.

Will the CCA 2025 make it harder for my customers to get approved?

Likely, yes. BNPL 2.0 requires more robust affordability assessments. This might mean slightly lower approval rates for high-risk individuals, but it also means fewer payment disputes and chargebacks for your business in the long run.

What are the penalties for non-compliance with the CCA 2025?

Penalties for violating the CCA can be severe, including substantial fines for the business and, in extreme cases of fraud or systemic negligence, criminal charges for the directors.

Can I still charge late fees to customers?

Late fees are still allowed, but they are now capped and must be transparently disclosed. You cannot hide the fee structure in the fine print; it must be visible at the moment the customer chooses to pay via BNPL.