OCC Releases Guidance on Risk Management for Buy Now, Pay Later Lending

On December 6, 2023, the Office of the Comptroller of the Currency (“OCC”) released Bulletin 2023-37 to provide guidance to national banks, federal savings associations, and federal branches and agencies of foreign banking organizations on the effective management of risks associated with “buy now, pay later” (“BNPL”) lending. The bulletin addresses BNPL loans that are payable in four or fewer installments and that carry no finance charges. The OCC explicitly provides that loans with payment terms that are greater than four installments or that charge interest or other finance charges are not within the scope of the bulletin.

Coupled with recent reports and publications on the BNPL industry released by the Consumer Financial Protection Bureau (the “CFPB”)^[1] and the Federal Reserve of New York,^[2] the bulletin serves to demonstrate that as BNPL lending is gaining popularity among lenders, merchants, and consumers, it is simultaneously gaining the attention of the regulators. The regulators appear to recognize the benefits of BNPL lending as contributing to financial inclusion and an expansion of access to credit, but remain wary of potential consumer harm.

Banks offering or looking to offer BNPL loans—whether or not regulated by the OCC—should structure their BNPL loan programs within a sound risk management system that incorporates the terms and suggestions of Bulletin 2023-37.

Background on BNPL Lending

BNPL lending is a point-of-sale installment payment option that has risen in popularity among consumers and merchants in recent years. While the features of a BNPL loan may vary, in the typical BNPL transaction, the lender pays the merchant for the good or service on behalf of the borrower and grants credit to, and collects payment from, the borrower. As compensation for the lender’s risk of borrower default, the merchant charges the lender a discounted price on the total purchase price, while the lender collects the full purchase price of the good or service from the borrower. Payments are often made automatically from a borrower’s debit card, credit card, or checking account. If a borrower does not make a payment on time, the lender may take action against the borrower, including by assessing late fees.

OCC Guidance

The bulletin indicates that the OCC recognizes the popularity and benefit of BNPL loans. It notes that use of BNPL loans to pay for goods and services has risen across all demographics, most rapidly among “tech-savvy younger generations and consumers with limited or no credit bureau history,” according to industry data. Further, the OCC recognizes that if BNPL loans are offered in a transparent manner and used responsibly by consumers, the loans can assist with cash-flow management and can serve as a convenient, low-cost, short-term financing option to consumers.

Nonetheless, the OCC cautions against the risks to banks and borrowers created by BNPL lending, which it describes as including credit, compliance, operational, strategic, and reputational risks. Accordingly, the bulletin advises banks offering BNPL loans to do so within a risk-management system commensurate with the associated risks of BNPL lending and provides suggested mitigants to manage the risks associated with BNPL loans.

Credit Risk Management

The bulletin describes certain aspects of BNPL lending that could increase the credit risk to banks. For example, the bulletin explains that (1) applicants may have limited or no credit history; (2) BNPL loans may not be fully captured in a borrower’s credit history if BNPL loans are approved via soft-pull credit bureau inquiries, or as a result of incomplete bureau reporting because of the shorn-term nature of the loans; and (3) traditional credit metrics to assess delinquencies and traditional charge-off policies that are typically used for long-term loans cannot be applied to BNPL loans payable in four or fewer installments. These conditions limit the information available to banks to underwrite BNPL loans and affect banks’ analyses of borrowers’ repayment capacities.

In addition, since BNPL loans are often tied to borrowers’ debit cards, credit cards, or checking accounts, borrowers may face risks of overdrafts or insufficient funds fees if they don’t fully understand their repayment obligations and are unable to make payments on their loans.

Accordingly, the OCC advises banks to maintain prudent lending policies that address underwriting criteria, loan terms, methodologies to assess repayment capacity, fees, charge-offs, and credit-loss-allowance considerations. The OCC explains that such policies, along with well-designed repayment methodologies—which could include debt-to-income, debt-to-assets, or residual income, or using deposit accounts for alternative data—could minimize adverse customer outcomes.

Among other things, the bulletin also emphasizes (1) the importance of ongoing monitoring and reporting to capture the unique risks of BNPL loans; (2) that banks should consider the use of specialized approaches with respect to debt collection to mitigate losses; and (3) that industry-wide reporting of BNPL loans would aid banks in identifying a borrower’s debts and repayment capacity, and enable borrowers making on-time payments to demonstrate positive credit behavior.

Operational Risk Management

The bulletin notes that the features of BNPL lending—such as its highly automated nature, the speed with which decisioning on loan applications is made, the reliance on third parties, and the prevalence of its use with online purchases—give rise to heightened operational risk, including fraud risk and model risk management. The OCC describes how BNPL loans can create service and support issues for borrowers. The bulletin further indicates that BNPL loans can present challenges with respect to merchandise returns and disputes, since a dispute may not be resolved during the term of the loan.

The OCC expects banks to implement measures to counter the operational and fraud risks. Such measures would include conducting assessments to consider common fraud schemes, establishing controls to handle merchandise returns and merchant disputes, and implementing processes to confirm the legal age of borrowers and to address first-payment defaults. The guidance also emphasizes that the use of credit models for BNPL loans should be subject to sound model risk management.

Third-Party Risk Management

Banks’ partnerships with third parties, including merchants, to offer BNPL loans can increase the risks related to BNPL lending. The OCC expects banks to have sound risk management processes, including to manage their third-party relationships. The guidance makes clear that, to the extent a bank partners with third parties, including with merchants, to offer BNPL loans, those third-party relationships should be incorporated by the bank into its third-party risk management processes.

Compliance Risk Management

According to the bulletin, several aspects of BNPL loans could lead to potential compliance concerns. For example, the timing, delivery, marketing, and disclosure language could impact a borrower’s understanding of obligations under the contract. The OCC advises that banks clearly describe borrower obligations, including any fees that could apply. In addition, the bulletin advises banks to consider the applicability of consumer-protection-related laws and regulations to BNPL loan products, such as the Equal Credit Opportunity Act and Regulation B, the Electronic Fund Transfer Act and Regulation E, the Fair Credit Reporting Act and Regulation V, Section 5 of the Federal Trade Commission Act, and Section 1036 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. The OCC makes clear that BNPL loans should be incorporated into a bank’s compliance management system (“CMS”).

Attorneys in the Financial Services practice at Winston & Strawn have extensive in-house and external counsel experience assisting financial institutions and their financial technology (“Fintech”) partners with the design and implementation of BNPL loan programs, and have specialized knowledge of third-party risk management requirements. Financial institutions or Fintechs with questions on Bulletin 2023-37 or regarding current or prospective BNPL loan programs are encouraged to contact attorneys in Winston’s Financial Services practice.

---

^{[1] The CFPB issued a report in September 2022, “Buy Now, Pay Later: Market trends and consumer impacts,” and a report in March 2023, “Consumer Use of Buy Now, Pay Later: Insights from the CFPB Making Ends Meet Survey.”}

^{[2] The Federal Reserve of New York released an analysis of BNPL lending, “Who Uses ‘Buy Now, Pay Later?’,” drawing on data derived from a survey of BNPL loan participants. https://libertystreeteconomics​.newyorkfed​.org/​2023/​09/who-uses-buy-now-pay-later/.}